Use-after-free in Linux kernel - CVE-2026-98367
Published: October 7, 2026
Vulnerability identifier: #VU153580
CSH Severity: Low
CVSS v4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98367
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to corrupt kernel memory.
The vulnerability exists due to use-after-free in the RDMA/siw siw_accept() function when cleaning up after a failed siw_qp_modify() call. A local user can trigger a concurrent queue pair transition to the error state to corrupt kernel memory.
Exploitation requires the concurrent transition to occur after the queue pair state lock is released but before connection endpoint cleanup completes.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-98367
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.113-1
linux (Debian package) - update to 6.12.113-1
External References
- https://git.kernel.org/stable/c/030306bbb9273af80f14d7af20129661964cd9a7
- https://git.kernel.org/stable/c/32cd87f54dd1070020e664ccb0312a9f0fea79b4
- https://git.kernel.org/stable/c/9dcc0f4e488b70cff81e0e5717a498c929cf5de3
- https://git.kernel.org/stable/c/ad50d19f3d1ce052b3a146143581e930a1efb33e
- https://git.kernel.org/stable/c/bfdc744bf20ae4c3ef2e470298de5237c5c9a13c
- https://git.kernel.org/stable/c/df2584750314336edcbcc21fb388e04b260f35b7
- https://git.kernel.org/stable/c/e3f039082856adab7e195dea1af45d93dd6a3f1c
- https://git.kernel.org/stable/c/f11e09fe2fc3a11ccdf8f932b68181b0bb1d2078