CVE-2026-74345 is a use-after-free in the Linux kernel's RDMA/siw subsystem, specifically in the siw_socket_disassoc() function. The vulnerability stems from a split ownership failure: the function silently absorbed cleanup responsibility for an endpoint, freeing it as a side effect, while calling code continued to hold and potentially dereference a stale socket pointer. This is a classic C API antipattern where functions both mutate and destroy their arguments without explicit signaling.
The trigger condition matters. This bug surfaced during malformed MPA request processing — an error path in the connection state machine that executes only when connection establishment fails. Error paths in RDMA's state machine are structurally under-tested because they require specific malformed inputs to reach. The 'happy path' of successful connection setup likely worked fine; the bug only manifests when the endpoint is closed mid-handshake.
The fix makes the ownership transfer explicit by moving socket pointer clearing inside siw_socket_disassoc() rather than relying on caller discipline. This is the right immediate fix, but the deeper lesson is about kernel driver API design patterns. RDMA subsystems have complex state machines with multiple interacting objects (sockets, endpoints, connection managers), and APIs in this space often accumulated side effects incrementally. Functions that initially just mutated state can gradually absorb resource destruction during refactoring, while callers drift out of sync because the contract shift wasn't audited.
For defenders: verify your kernel versions include the fix for this specific call path. More importantly, audit similar helper functions in RDMA and InfiniBand code for implicit ownership transfer — functions that both mutate and free shared state without clear signaling. Error paths in connection state machines deserve particular scrutiny; they're structurally under-reviewed and represent accumulated 'functional debt' where code executes but lacks active ownership. Static analysis tooling that tracks ownership transfer across function boundaries would catch this pattern, but human review of error paths remains the most reliable detection method for now.