CVE-2026-90171

A flaw was found in the SMB Direct (smbdirect) component of the Linux kernel. This vulnerability arises from an improper handling of child sockets during the shutdown process, where memory is released prematurely while still in use. A remote attacker could potentially exploit this timing issue to trigger a use-after-free condition. This could lead to system instability, crashes, or a denial of service.

A moderate-impact use-after-free flaw was found in the Linux kernel's ksmbd SMB Direct (RDMA) transport. During SMB Direct listener shutdown, smbdirect_socket_destroy() releases the listener's pending and ready child sockets while still holding the listener's handler lock and before the listener's own rdma_destroy_id() completes. Releasing a child socket drops its last reference and destroys its cm_id, which allows _cma_cancel_listens(), invoked from the listener's _destroy_id(), to traverse an already-freed child id_priv; KASAN confirmed this as a slab use-after-free during listener shutdown. A remote system with access to the RDMA fabric can supply the pending child connection needed to set up this teardown ordering, but the demonstrated trigger path also requires an administrative action on the local host to stop the ksmbd listener, so successful exploitation results in a kernel crash and denial of service, with no impact on confidentiality or integrity. Red Hat therefore rated this flaw Moderate with a local attack vector (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which is lower than the remote attack vector suggested in the upstream CVE description. The flaw affects Red Hat products that ship the vulnerable Linux kernel ksmbd SMB Direct code; other Red Hat products evaluated for this flaw are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.