Executive brief
A vulnerability in the Linux kernel's SMB client could allow a local user to cause a system crash. The issue occurs when the system attempts to close an SMB Direct connection while background tasks are still trying to access memory that is being deleted. This can lead to operational instability or a complete system shutdown in environments using high-performance storage networking.
Technical details
A race condition exists in the SMB Direct (SMBD) implementation within the Linux kernel's CIFS/SMB client. When smbd_destroy() is called to tear down a connection, it may destroy memory structures while 'post_send_credits_work' is still pending or executing in the workqueue. Specifically, ib_drain_qp() can trigger put_receive_buffer(), which re-queues work after the RDMA Queue Pair (QP) has been targeted for destruction. This results in a use-after-free or invalid access when the worker thread eventually runs. The fix introduces a call to disable_work_sync() in smbd_destroy() to ensure all pending work is cancelled or completed before memory is freed.
Affected products
- Linux Linux Kernel 4.16 to 6.12.48, 6.13 to 6.16.8
Timeline
- 2025-08-12: other: Patch authored
- 2025-09-17: patched: Fix committed to mainline kernel
- 2025-10-04: disclosed: CVE published