CVE-2026-90172

A flaw was found in the Linux kernel's smbdirect module, which handles high-performance data transfer using Remote Direct Memory Access (RDMA). During an RDMA connection attempt, if the connection acceptance fails, the system incorrectly deallocates memory resources before all related operations are finalized. This can lead to a NULL-pointer dereference, causing the system to crash and resulting in a Denial of Service (DoS).

An incorrect teardown order in the SMB Direct accept failure path can destroy the receive memory pool and slab cache while a posted recv_io object is still owned by the RDMA QP. Draining the QP later invokes the receive completion and returns that object through already destroyed allocation infrastructure, producing allocator warnings, BAD_PAGE state, and a NULL pointer dereference in mempool_free_bulk. A remote RDMA peer may potentially reach this path before SMB authentication by initiating an SMB Direct connection that fails during RDMA acceptance. For the CVSS the PR:N is used because the peer does not need an authenticated account or privileges on the target when the SMB Direct listener is reachable. AV:A and AC:H are used because access normally requires adjacency to the RDMA fabric and reliable triggering depends on an accept failure after the receive object has been posted. The demonstrated impact is a kernel crash and denial of service. SMB Direct is normally limited to trusted data center or storage networks and is rarely exposed to the public Internet.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.