CVE-2026-23242

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23242
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Fix potential NULL pointer dereference in header processing If siw_get_hdr() returns -EINVAL before set_rx_fpdu_context(), qp->rx_fpdu can be NULL. The error path in siw_tcp_rx_data() dereferences qp->rx_fpdu->more_ddp_segs without checking, which may lead to a NULL pointer deref. Only check more_ddp_segs when rx_fpdu is present. KASAN splat: [ 101.384271] KASAN: null-ptr-deref in range [0x00000000000000c0-0x00000000000000c7] [ 101.385869] RIP: 0010:siw_tcp_rx_data+0x13ad/0x1e50

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/14ab3da122bd18920ad57428f6cf4fade8385142 Patch
https://git.kernel.org/stable/c/714c99e1dc8f85f446e05be02ba83972e981a817 Patch
https://git.kernel.org/stable/c/8564dcc12fbb372d984ab45768cae9335777b274 Patch
https://git.kernel.org/stable/c/87b7a036d2c73d5bb3ae2d47dee23de465db3355 Patch
https://git.kernel.org/stable/c/ab61841633d10e56a58c1493a262f0d02dba2f5e Patch
https://git.kernel.org/stable/c/ab957056192d6bd068b3759cb2077d859cca01f0 Patch
https://git.kernel.org/stable/c/ce025f7f5d070596194315eb2e4e89d568b8a755 Patch
https://git.kernel.org/stable/c/ffba40b67663567481fa8a1ed5d2da36897c175d Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.3:-:*:*:*:*:*:*
History

21 May 2026, 15:43

Type Values Removed Values Added
CWE CWE-476
CPE cpe:2.3:o:linux:linux_kernel:5.3:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/14ab3da122bd18920ad57428f6cf4fade8385142 - () https://git.kernel.org/stable/c/14ab3da122bd18920ad57428f6cf4fade8385142 - Patch
References () https://git.kernel.org/stable/c/714c99e1dc8f85f446e05be02ba83972e981a817 - () https://git.kernel.org/stable/c/714c99e1dc8f85f446e05be02ba83972e981a817 - Patch
References () https://git.kernel.org/stable/c/8564dcc12fbb372d984ab45768cae9335777b274 - () https://git.kernel.org/stable/c/8564dcc12fbb372d984ab45768cae9335777b274 - Patch
References () https://git.kernel.org/stable/c/87b7a036d2c73d5bb3ae2d47dee23de465db3355 - () https://git.kernel.org/stable/c/87b7a036d2c73d5bb3ae2d47dee23de465db3355 - Patch
References () https://git.kernel.org/stable/c/ab61841633d10e56a58c1493a262f0d02dba2f5e - () https://git.kernel.org/stable/c/ab61841633d10e56a58c1493a262f0d02dba2f5e - Patch
References () https://git.kernel.org/stable/c/ab957056192d6bd068b3759cb2077d859cca01f0 - () https://git.kernel.org/stable/c/ab957056192d6bd068b3759cb2077d859cca01f0 - Patch
References () https://git.kernel.org/stable/c/ce025f7f5d070596194315eb2e4e89d568b8a755 - () https://git.kernel.org/stable/c/ce025f7f5d070596194315eb2e4e89d568b8a755 - Patch
References () https://git.kernel.org/stable/c/ffba40b67663567481fa8a1ed5d2da36897c175d - () https://git.kernel.org/stable/c/ffba40b67663567481fa8a1ed5d2da36897c175d - Patch
First Time Linux linux Kernel
Linux

02 Apr 2026, 15:16

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: RDMA/siw: Soluciona una posible desreferencia de puntero NULL en el procesamiento de encabezados Si siw_get_hdr() devuelve -EINVAL antes de set_rx_fpdu_context(), qp->rx_fpdu puede ser NULL. La ruta de error en siw_tcp_rx_data() desreferencia qp->rx_fpdu->more_ddp_segs sin verificar, lo que puede llevar a una desreferencia de puntero NULL. Solo verificar more_ddp_segs cuando rx_fpdu está presente. KASAN splat: [ 101.384271] KASAN: desreferencia de puntero nulo en el rango [0x00000000000000c0-0x00000000000000c7] [ 101.385869] RIP: 0010:siw_tcp_rx_data+0x13ad/0x1e50
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.5

18 Mar 2026, 11:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-18 11:16

Updated : 2026-05-21 15:43

NVD link : CVE-2026-23242

Mitre link : CVE-2026-23242

CVE.ORG link : CVE-2026-23242

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-476

NULL Pointer Dereference