CVE-2026-98323: Linux Kernel RDMA/siw Buffer Overflow

CVE-2026-98323 Overview

CVE-2026-98323 is an out-of-bounds write vulnerability in the Linux kernel's Soft iWARP (siw) RDMA driver. The flaw resides in siw_get_hdr(), which processes extended Direct Data Placement (DDP) and Remote Direct Memory Access Protocol (RDMAP) headers delivered across multiple TCP callbacks. Incorrect copy-length arithmetic allows the destination pointer to move past the end of the header buffer and corrupt the receive state, including fpdu_part_rcvd. A subsequent callback can then interpret a negative fpdu_part_rcvd as a copy offset, producing an out-of-bounds write reachable from the network.

Critical Impact
Remote attackers who can establish an iWARP/TCP session with a vulnerable siw endpoint can trigger kernel memory corruption, enabling denial of service or potential remote code execution in kernel context.

Affected Products

Linux kernel builds that enable the siw (Soft iWARP) RDMA driver
Stable branches referenced by the fix commits 262dcd80, 2c6fbcf4, 8628f8eb, 9ff797e5, af9f5b47, b72dcfb9, e6bdfdf3, and eb4d7a94
Distributions shipping affected kernels with CONFIG_RDMA_SIW enabled

Discovery Timeline

2026-10-06 - CVE-2026-98323 published to the National Vulnerability Database
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2026-98323

Vulnerability Analysis

The Soft iWARP driver implements iWARP over standard TCP sockets, parsing DDP/RDMAP headers as segments arrive from the transport layer. Because TCP does not preserve message boundaries, siw_get_hdr() must handle extended headers that span more than one receive callback. The handler tracks how many header bytes have already been copied and intends to request only the remaining bytes on each subsequent callback.

The defective code calculates the next copy length as hdrlen - MIN_DDP_HDR rather than subtracting the bytes already received. When the first callback delivers most of the header, the second callback over-copies into the receive-state structure that immediately follows the header buffer. This overwrites fields including fpdu_part_rcvd, which represents the number of Framed Protocol Data Unit (FPDU) bytes received so far.

A later callback trusts the corrupted fpdu_part_rcvd value and uses it as an offset for additional copies. If the overwritten value is negative, the resulting pointer arithmetic produces an out-of-bounds write into adjacent kernel memory.

Root Cause

The root cause is incorrect boundary arithmetic in fragmented header reassembly. The copy length was derived from a constant header-size expression instead of from the number of header bytes still outstanding, violating the invariant that each callback should copy at most hdrlen - bytes_already_received bytes.

Attack Vector

Exploitation requires network reachability to a TCP endpoint bound to the Soft iWARP driver. An attacker sends a crafted iWARP stream that fragments an extended DDP/RDMAP header across multiple TCP segments, forcing siw_get_hdr() down the vulnerable path. No authentication or user interaction is required when siw is exposed to attacker-controlled networks. See the upstream commits (262dcd80, eb4d7a94) for the corrected length calculation.

Detection Methods for CVE-2026-98323

Indicators of Compromise

Unexpected kernel oops or panic entries referencing siw_get_hdr, siw_qp_llp_data_ready, or neighboring siw_rx_* symbols in dmesg and /var/log/messages
KASAN out-of-bounds write reports naming the siw receive path when kernel address sanitizer is enabled
Abrupt RDMA connection resets or iWARP queue-pair failures correlated with inbound TCP flows carrying malformed DDP/RDMAP headers

Detection Strategies

Audit loaded kernel modules for siw on hosts not intentionally running Soft iWARP, using lsmod | grep siw across the fleet
Monitor network telemetry for inbound TCP sessions to iWARP service ports from untrusted sources, since legitimate siw deployments are typically confined to trusted fabrics
Correlate kernel crash telemetry with recent RDMA traffic to surface attempted exploitation

Monitoring Recommendations

Forward kernel ring buffer and crash-dump data to a centralized logging platform for retention and alerting
Enable KASAN or kernel lockdown on canary hosts to catch early exploitation attempts
Track RDMA subsystem health counters (/sys/class/infiniband/*) for abnormal error rates on siw devices

How to Mitigate CVE-2026-98323

Immediate Actions Required

Apply the stable-kernel updates that incorporate the upstream fix commits listed in the NVD references
Where patching is not immediately possible, unload the siw module on systems that do not require Soft iWARP: modprobe -r siw
Blacklist the siw module on hosts with no RDMA requirement to prevent automatic reload
Restrict exposure of iWARP endpoints to trusted management networks only

Patch Information

The fix changes siw_get_hdr() to compute the next copy length from the number of header bytes already received, preventing writes past the header buffer. Patched builds are available via the stable kernel commits 262dcd80, 2c6fbcf4, 8628f8eb, 9ff797e5, af9f5b47, b72dcfb9, e6bdfdf3, and eb4d7a94. Rebuild or upgrade distribution kernels to a release containing these commits.

Workarounds

Disable the siw driver when hardware RDMA adapters or Soft iWARP are not in use
Enforce network segmentation so only authenticated RDMA peers can reach iWARP TCP ports
Apply host-based firewall rules to drop unsolicited inbound traffic to iWARP service ports

bash

# Prevent the vulnerable Soft iWARP driver from loading
sudo modprobe -r siw
echo 'blacklist siw' | sudo tee /etc/modprobe.d/blacklist-siw.conf
sudo update-initramfs -u

# Verify the module is no longer loaded after reboot
lsmod | grep -c '^siw'