Executive brief
The Linux kernel's SMB over RDMA (smbdirect) implementation contains a flaw in error handling during connection setup where resources are destroyed in the wrong order. When a connection acceptance fails, the kernel attempts to free memory pools before properly draining a queue pair, leaving pending I/O operations that cause kernel memory management failures and system instability.
Technical details
The vulnerability is a resource cleanup order bug in the SMB Direct (smbdirect) RDMA connection handler. During accept failure in smbdirect_accept_connect_request(), a receive I/O object (recv_io) is posted to the queue pair (QP) but then the error path destroys memory pools before draining the QP. The QP drain (ib_drain_qp) completes pending recv operations and returns objects to the free list; by destroying pools first, the kernel leaves recv_io outstanding at kmem_cache_destroy() time. This causes slab cache errors and NULL-pointer dereferences when the object is later freed to the destroyed mempool. The fix reorders error handling so failed rdma_accept calls drain the QP before destroying memory pools. A network-based attacker can trigger this by initiating an RDMA connection that fails acceptance, causing a kernel crash or denial of service.
Affected products
- Linux Linux kernel 7.1.0-next and earlier
Timeline
- 2026-09-17: disclosed