CVE-2026-90107

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/smc: free pending qentry in smc_llc_flow_stop() before memset

smc_llc_flow_stop() resets a flow struct with a blind memset:

spin_lock_bh(&lgr->llc_flow_lock);

memset(flow, 0, sizeof(*flow));

flow->type = SMC_LLC_FLOW_NONE;

spin_unlock_bh(&lgr->llc_flow_lock);

If flow->qentry is non-NULL at this point the pointer is overwritten without the

allocation being freed, leaking one kmalloc object.

A late-arriving duplicate CONFIRM_LINK or ADD_LINK_CONT message can set

flow->qentry after the legitimate message has been consumed by the waiter via

smc_llc_flow_qentry_clr() (which NULLs the pointer but leaves flow->type

non-zero) but before the flow completes and smc_llc_flow_stop() runs. In that

window the duplicate is stashed into flow->qentry, and then lost when

smc_llc_flow_stop() zeros the struct.

Call smc_llc_flow_qentry_del() inside the lock before the memset.

smc_llc_flow_qentry_del() already checks flow->qe

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References