CVE-2026-90173

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

smb: smbdirect: free completion queues with ib_free_cq()

smbdirect_connection_destroy_qp() creates the send and receive completion

queues with ib_alloc_cq_any(), which for IB_POLL_WORKQUEUE arms an

internal completion handler that runs ib_cq_poll_work() on a workqueue.

Tearing those CQs down with ib_destroy_cq() frees them without first

cancelling that poll work.

If the provider posts a completion late -- for example Soft-RoCE (rxe)

posting an RNR error from rxe_receiver() after rdma_destroy_qp() -- the

handler re-queues ib_cq_poll_work() on the already-freed CQ, and a

follow-on access faults in rxe_req_notify_cq().

Use ib_free_cq(), which cancel_work_sync()es the poll work before freeing

the CQ, so no completion handler can run against a freed queue.

[ 1236.599526] ==================================================================

[ 1236.602142] BUG: KASAN: slab-use-after-free in ib_cq_poll_work+0xd0/0x1a0

[ 1236

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References