External risk intelligence

Linux Kernel RDMA siw Endpoint Association Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-74345

The vulnerability affects the RDMA over Software iWARP (siw) driver within the Linux kernel. RDMA protocols are typically deployed in specialized, high-performance internal data center or cluster environments. While network-reachable in those specific configurations, they are rarely exposed directly to the public internet.

Use After Free

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This Linux kernel vulnerability, related to how network connections are managed, could allow for significant disruption if exploited. The issue arises from a flaw in handling the association between network endpoints and sockets, potentially leading to system instability. Understanding the scope of its applicability to our specific environments is the primary concern.

A technical issue with Linux network connection handling.
It could impact system stability and data integrity.
Confirm relevance and exposure to our systems.

Attack Path

How an attacker could exploit the issue

An attacker could reach this vulnerability by sending a specially crafted network request during the connection establishment phase. This malformed request targets the Linux kernel's RDMA/siw component, which improperly handles socket and endpoint associations. Successful exploitation could lead to system instability or a crash.

Network access required.
Malformed MPA request triggers vulnerability.
Potential for system instability or crash.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, processing a malformed MPA request during connection establishment could affect the handling of new endpoints in the Linux kernel's RDMA/siw driver, potentially leading to a use-after-free condition.

Kernel memory could be affected.
Malformed requests may trigger the issue.
System instability or crashes could occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability impacts the Linux kernel's RDMA subsystem, specifically the siw driver, and could be exploited through malformed network requests. Owners of infrastructure running the Linux kernel with RDMA/siw enabled should prioritize identifying affected systems, assessing their business criticality and network exposure, and then coordinating remediation.

Infrastructure teams should own the issue.
Verify RDMA/siw usage and network reachability.
Plan remediation based on system criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel siw component?

The siw driver stands for Software iWARP. It is a component within the Linux kernel that enables Remote Direct Memory Access (RDMA) over standard TCP/IP networks. It is commonly used in high-performance computing clusters and enterprise data centers to allow fast, low-latency data transfer between servers without burdening the host processor.

How does this flaw create a use-after-free condition?

This vulnerability involves a memory management error where the kernel attempts to access data after it has already been freed. Specifically, the siw driver improperly handles the association between a network endpoint and a socket. If the association is cleared too early, the system tries to reference memory that no longer exists, which is a classic use-after-free weakness.

Do malformed requests always trigger this crash?

No. The vulnerability is specifically triggered by a malformed MPA (Marker PDU Aligned) request during the connection establishment phase. Simply having the siw driver active or communicating normally does not cause this issue. The kernel must process this specific type of improperly formatted packet while attempting to open a new RDMA connection.

Is my system at risk if it is not on the internet?

Halo Surface Signal indicates this vulnerability is unlikely to be a threat to public-facing systems because RDMA protocols like siw are almost exclusively deployed within private, high-performance internal network segments. If your servers are not configured to use the siw driver for specialized internal traffic, they are not reachable by this threat.

When should I prioritize a patch for CVE-2026-74345?

You should prioritize remediation if your infrastructure runs the Linux kernel with the siw driver enabled in a production environment. Start by identifying which servers utilize RDMA over Software iWARP. Once identified, evaluate the criticality of those systems and plan for a kernel update to ensure the endpoint and socket association logic is corrected.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.