CVE-2026-90172

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smb: smbdirect: destroy QP before mem pools on accept failure

On the rdma_accept_failed error path of

smbdirect_accept_connect_request(), the receive io posted just above is

owned by the QP (recv_io is set to NULL after a successful post). The

error path fell through to smbdirect_connection_destroy_mem_pools()

before smbdirect_connection_destroy_qp(), so the mem pools and the

recv_io slab cache were destroyed while that recv_io was still

outstanding on the QP.

The drain in smbdirect_connection_destroy_qp() (ib_drain_qp()) is what

runs the recv completion that returns the recv_io to the free list, so

destroying the pools first leaves the object outstanding at

kmem_cache_destroy() time ("Slab cache still has objects") and later

frees it into an already-destroyed mempool (mempool_free_bulk

NULL-pointer dereference).

Give rdma_accept_failed its own teardown that drains the QP first, then

destroys the mem pools, and re

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References