CVE-2026-68417

CVE-2026-68417 is a race condition in the siw RDMA driver where siw_qp_add() publishes a Queue Pair to the QPN lookup namespace before QP initialization completes. The window is narrow, but the consequences extend well beyond a kernel crash. The vulnerability description frames this as an ordering bug. What's materially different from a generic kernel race is the interaction between QPN lookup and DMA machinery. When a Queue Pair appears in the QPN namespace mid-initialization, the Completion Queue pointer may be NULL, queue state undefined, or completion structures uninitialized. RDMA hardware doesn't check whether a QP is 'ready' before attempting queue operations—it trusts the kernel's data structures. If hardware initiates a DMA transaction during this window, the result isn't just a NULL dereference panic. Depending on timing, you can get memory corruption that propagates to remote peer memory through RDMA write operations, or inconsistent completion reporting that survives the QP's full lifetime. This is a different threat model than local privilege escalation. The CVSS 7.8 reflects local impact but doesn't model RDMA's blast radius. A corrupted QP can cause unpredictable data corruption on remote systems that have no visibility into the QP's initialization state. If you run siw in production, treat this as higher severity than the score suggests. For defenders: verify your kernel version contains the siw_qp_add() reorder. Examine your siw deployment footprint—even if siw is loaded, active iWARP connections create the exposure. The fix moves the publish call but doesn't add an explicit state-check gate in the QPN lookup path, so the race window is reduced but not architecturally closed. If you're auditing similar drivers in the RDMA subsystem, look for other publish-before-ready patterns where QP state can be reached mid-construction.

Reviewed through automated stages and approved by a human before publication.