CVE-2026-90107: net/smc: free pending qentry in smc_llc_flow_stop() before memset
In the Linux kernel, the following vulnerability has been resolved:
net/smc: free pending qentry in smcllcflowstop() before memset
smcllcflowstop() resets a flow struct with a blind memset:
spinlockbh(&lgr->llcflowlock); memset(flow, 0, sizeof(flow)); flow->type = SMCLLCFLOWNONE; spinunlockbh(&lgr->llcflowlock);
If flow->qentry is non-NULL at this point the pointer is overwritten without the allocation being freed, leaking one kmalloc object.
A late-arriving duplicate CONFIRMLINK or ADDLINKCONT message can set flow->qentry after the legitimate message has been consumed by the waiter via smcllcflowqentryclr() (which NULLs the pointer but leaves flow->type non-zero) but before the flow completes and smcllcflowstop() runs. In that window the duplicate is stashed into flow->qentry, and then lost when smcllcflowstop() zeros the struct.
Call smcllcflowqentrydel() inside the lock before the memset. smcllcflowqentrydel() already checks flow->qentry before freeing, so the normal case where no entry is pending is a no-op.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In net/smc, update smc_llc_flow_stop() to free any pending flow->qentry (using smc_llc_flow_qentry_del()/equivalent logic that checks flow->qentry) before the blind memset that zeros the flow struct; ensure the qentry free happens under the appropriate lock (as described: hold llc_flow_lock while freeing) and before memset(flow, 0, sizeof(*flow)).
Linux kernel net/smc smc_llc_flow_stop() free pending qentry before memset = Implement fix: free pending qentry in smc_llc_flow_stop() before memset(flow, 0, sizeof(*flow))
Event History
Frequently Asked Questions
What traffic condition is required for the leak to occur?
A duplicate CONFIRM_LINK or ADD_LINK_CONT message must arrive after the legitimate message has been consumed by the waiter, but before the flow completes and is reset. The duplicate message can then be stored in the flow's qentry pointer during that window.
What is the impact when the race is triggered?
One kmalloc object is leaked because the pending qentry pointer is overwritten when the flow structure is zeroed. The affected flow cleanup path must delete the pending qentry before resetting the structure.