CVE-2026-90108: net/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LINK transition

In the Linux kernel, the following vulnerability has been resolved:

net/smc: free stashed qentry before overwrite in REQADDLINK to ADDLINK transition

When smcllceventhandler() transitions the local LLC flow from SMCLLCFLOWREQADDLINK to SMCLLCFLOWADDLINK on arrival of an ADDLINK request, it calls smcllcflowqentryset() unconditionally:

if (lgr->llcflowlcl.type == SMCLLCFLOWREQADDLINK) { lgr->llcflowlcl.type = SMCLLCFLOWADDLINK; smcllcflowqentryset(&lgr->llcflowlcl, qentry); ... }

A CONFIRMLINK or ADDLINKCONT arriving while flow->type is SMCLLCFLOWREQADDLINK is stashed into flow->qentry via the SMCLLCCONFIRMLINK / SMCLLCADDLINKCONT handler (which stores into flow->qentry for any non-NONE flow type). When the subsequent ADDLINK arrives, the REQADDLINK branch overwrites flow->qentry with the new pointer without first freeing the stashed allocation, leaking one kmalloc object.

The stashed entry has no consumer: smcllcwait() is only called from llcaddlinkwork, which is not yet scheduled while the flow type remains REQADDLINK. No waiter is sleeping on llcmsgwaiter at this point. It is safe to unconditionally free any stashed qentry before the overwrite.

Call smcllcflowqentrydel() before smcllcflowqentryset() in the REQADDLINK branch. smcllcflowqentrydel() already checks flow->qentry before freeing, so the normal path where no entry is stashed is a no-op.