Junglewise Threat Intelligence

CVE-2026-90172: Linux kernel smb smbdirect resource management order vulnerability

CVE-2026-90172 · Severity: high · CVSS 7.5 · Published 2026-09-17

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

The Linux kernel's SMB over RDMA (smbdirect) implementation contains a flaw in error handling during connection setup where resources are destroyed in the wrong order. When a connection acceptance fails, the kernel attempts to free memory pools before properly draining a queue pair, leaving pending I/O operations that cause kernel memory management failures and system instability.

Technical details

The vulnerability is a resource cleanup order bug in the SMB Direct (smbdirect) RDMA connection handler. During accept failure in smbdirect_accept_connect_request(), a receive I/O object (recv_io) is posted to the queue pair (QP) but then the error path destroys memory pools before draining the QP. The QP drain (ib_drain_qp) completes pending recv operations and returns objects to the free list; by destroying pools first, the kernel leaves recv_io outstanding at kmem_cache_destroy() time. This causes slab cache errors and NULL-pointer dereferences when the object is later freed to the destroyed mempool. The fix reorders error handling so failed rdma_accept calls drain the QP before destroying memory pools. A network-based attacker can trigger this by initiating an RDMA connection that fails acceptance, causing a kernel crash or denial of service.

Affected products

  • Linux Linux kernel 7.1.0-next and earlier

Timeline

  • 2026-09-17: disclosed

Related threats