MiracleLinux 8 : kernel-4.18.0-553.170.1.el8_10 (AXSA:2026-2015:96)

The remote MiracleLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-2015:96 advisory. kernel: RDMA/siw: Reject MPA FPDU length underflow before signed receive math CVE-2026-64102 kernel: vmxnet3: fix BUGON in vmxnet3gethdrlen for Gene...

Astra Linux – vulnerability in linux-5.15

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix QP destroy to wait for all references dropped. Delay QP destroy completion until all siw references to QP are dropped. The calling RDMA core will free QP structure after successful return from siwqpdestroy call; thu...

Astra Linux – vulnerability in linux-5.10, linux-5.15, linux

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix immediate work request flush to completion queue The send queue element opcode must be correctly set during the immediate work request flushing phase in post-sendqueue operations, provided that the QP is in an ERROR...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: A low-value MPA length field was rejected during signed receive math calculations. A malicious connected SIW peer can send an iWARP FPDU whose MPA length field chdr-mpalen, 16-bit big-endian, peer-controlled is smaller...

Astra Linux – vulnerability in linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: publish QP after initialization Currently, siwcreateqp calls siwqpadd before the queues, CQ pointers, state, completion, and device list entries are fully prepared. As a result, a QPN lookup may result in a QP that is...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fixed a use-after-free in siwaccept siwaccept looks up the QP provided by the user space. If that QP is already in RTS, the function jumps to error cleanup before associating the incoming CEP with it. The cleanup checks...

Astra Linux – Vulnerability in Linux

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fixed an issue where free was called after the memory was allocated. Our code analyzer reported a Use-after-Free UAF vulnerability. In the function siwallocmr, it calls siwmraddmemmr,.... In the implementation of...

Astra Linux – vulnerability in linux-5.10, linux-6.1, linux-5.15

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response placement to the RREAD length In drivers/infiniband/sw/siw/siwqprx.c, siwprocrresp places each inbound Read Response DDP segment at sge-laddr + wqe-processed and then increments wqe-processed; howeve...

CVE-2026-90292

A flaw was found in the Linux kernel's RDMA/siw component. The siwaccept function, when handling a Queue Pair QP already in the Ready To Send RTS state, can incorrectly manage connection endpoints CEP during cleanup. This can lead to a use-after-free vulnerability, where a freed memory region is...

SUSE CVE-2026-98323

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siwgethdr can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still...

SUSE CVE-2026-98367

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Clear association under lock if siwqpmodify fails in siwaccept We need to clear cep before release statelock as siwqpllpclose and siwqpmodify-siwqpllpclose did. Otherwise if siwqpmodify fails in siwaccept, the QP's...

CVE-2026-98367

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Clear association under lock if siwqpmodify fails in siwaccept We need to clear cep before release statelock as siwqpllpclose and siwqpmodify-siwqpllpclose did. Otherwise if siwqpmodify fails in siwaccept, the QP's...

AZL-106176 CVE-2026-98367 affecting package kernel for versions less than 6.6.158.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Clear association under lock if siwqpmodify fails in siwaccept We need to clear cep before release statelock as siwqpllpclose and siwqpmodify-siwqpllpclose did. Otherwise if siwqpmodify fails in siwaccept, the QP's...

DEBIAN-CVE-2026-98367

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Clear association under lock if siwqpmodify fails in siwaccept We need to clear cep before release statelock as siwqpllpclose and siwqpmodify-siwqpllpclose did. Otherwise if siwqpmodify fails in siwaccept, the QP's...

CVE-2026-98323

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siwgethdr can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still...

DEBIAN-CVE-2026-98323

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siwgethdr can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still...

AZL-106458 CVE-2026-98323 affecting package kernel for versions less than 6.6.158.1-1

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siwgethdr can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still...

CVE-2026-98323

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siwgethdr can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still...

CVE-2026-98367

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Clear association under lock if siwqpmodify fails in siwaccept We need to clear cep before release statelock as siwqpllpclose and siwqpmodify-siwqpllpclose did. Otherwise if siwqpmodify fails in siwaccept, the QP's...

UBUNTU-CVE-2026-98323

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siwgethdr can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still...