CVE-2026-90108: net/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LINK transition
In the Linux kernel, the following vulnerability has been resolved:
net/smc: free stashed qentry before overwrite in REQADDLINK to ADDLINK transition
When smcllceventhandler() transitions the local LLC flow from SMCLLCFLOWREQADDLINK to SMCLLCFLOWADDLINK on arrival of an ADDLINK request, it calls smcllcflowqentryset() unconditionally:
if (lgr->llcflowlcl.type == SMCLLCFLOWREQADDLINK) { lgr->llcflowlcl.type = SMCLLCFLOWADDLINK; smcllcflowqentryset(&lgr->llcflowlcl, qentry); ... }
A CONFIRMLINK or ADDLINKCONT arriving while flow->type is SMCLLCFLOWREQADDLINK is stashed into flow->qentry via the SMCLLCCONFIRMLINK / SMCLLCADDLINKCONT handler (which stores into flow->qentry for any non-NONE flow type). When the subsequent ADDLINK arrives, the REQADDLINK branch overwrites flow->qentry with the new pointer without first freeing the stashed allocation, leaking one kmalloc object.
The stashed entry has no consumer: smcllcwait() is only called from llcaddlinkwork, which is not yet scheduled while the flow type remains REQADDLINK. No waiter is sleeping on llcmsgwaiter at this point. It is safe to unconditionally free any stashed qentry before the overwrite.
Call smcllcflowqentrydel() before smcllcflowqentryset() in the REQADDLINK branch. smcllcflowqentrydel() already checks flow->qentry before freeing, so the normal path where no entry is stashed is a no-op.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1
Event History
Frequently Asked Questions
What event sequence triggers the leak?
A CONFIRM_LINK or ADD_LINK_CONT must arrive while the local LLC flow is in SMC_LLC_FLOW_REQ_ADD_LINK, causing its queue entry to be stashed. A subsequent ADD_LINK request then transitions the flow to SMC_LLC_FLOW_ADD_LINK and overwrites that stored pointer without freeing it.
What is the immediate impact of the affected path?
One kmalloc object is leaked when the stashed queue entry is overwritten. The stashed entry has no consumer in this state: link-add work has not yet been scheduled and no waiter is sleeping on llc_msg_waiter.