CVE-2026-90171

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smb: smbdirect: release pending child sockets outside the handler lock

smbdirect_socket_destroy() releases the listener's pending/ready child

sockets while still holding the listener's handler lock, the

&id_priv->handler_mutex taken via rdma_lock_handler(), not

sc->listen.lock, and before the listener's own rdma_destroy_id().

That ordering has one real consequence and one cosmetic one.

The real one: smbdirect_socket_release() drops the child's last

reference, which destroys the child's cm_id. Doing that before the

listener's rdma_destroy_id() lets _cma_cancel_listens(), running from

the listener's _destroy_id(), walk an already freed child id_priv,

which KASAN catches as a slab-use-after-free during listener shutdown:

[ 4758.909130] BUG: KASAN: slab-use-after-free in __mutex_lock+0x1469/0x1560

[ 4758.911450] Read of size 1 at addr ffff88821c381db4 by task ksmbd.control/1652

[ 4758.913262] Call Trace:

[ 4758.913267

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References