CVE-2026-90107: net/smc: free pending qentry in smc_llc_flow_stop() before memset
In the Linux kernel, the following vulnerability has been resolved:
net/smc: free pending qentry in smcllcflowstop() before memset
smcllcflowstop() resets a flow struct with a blind memset:
spinlockbh(&lgr->llcflowlock); memset(flow, 0, sizeof(flow)); flow->type = SMCLLCFLOWNONE; spinunlockbh(&lgr->llcflowlock);
If flow->qentry is non-NULL at this point the pointer is overwritten without the allocation being freed, leaking one kmalloc object.
A late-arriving duplicate CONFIRMLINK or ADDLINKCONT message can set flow->qentry after the legitimate message has been consumed by the waiter via smcllcflowqentryclr() (which NULLs the pointer but leaves flow->type non-zero) but before the flow completes and smcllcflowstop() runs. In that window the duplicate is stashed into flow->qentry, and then lost when smcllcflowstop() zeros the struct.
Call smcllcflowqentrydel() inside the lock before the memset. smcllcflowqentrydel() already checks flow->qentry before freeing, so the normal case where no entry is pending is a no-op.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.190-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Compensating control
In smc_llc_flow_stop(), call smc_llc_flow_qentry_del() while holding lgr->llc_flow_lock, before memset(flow, 0, sizeof(*flow)), to free any pending flow->qentry.
Event History
Frequently Asked Questions
What traffic condition is required for the leak to occur?
A duplicate CONFIRM_LINK or ADD_LINK_CONT message must arrive after the legitimate message has been consumed by the waiter, but before the flow completes and is reset. The duplicate message can then be stored in the flow's qentry pointer during that window.
What is the impact when the race is triggered?
One kmalloc object is leaked because the pending qentry pointer is overwritten when the flow structure is zeroed. The affected flow cleanup path must delete the pending qentry before resetting the structure.