CVE-2026-90108
kernel: net/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LINK transition
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · September 17, 2026
Updated · October 6, 2026
Description
A flaw was found in the Linux kernel's net/smc component. During a specific state transition in the smc_llc_event_handler(), a previously stashed memory object (qentry) is overwritten without being properly freed. This oversight leads to a memory leak, where allocated memory is not released, potentially impacting system stability or resource availability over time.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-772 · Missing Release of Resource after Effective Lifetime