GHSA-6X7F-MRC2-297F

Vulnerability from github – Published: 2026-09-17 18:31 – Updated: 2026-09-17 18:31
VLAI
Details

In the Linux kernel, the following vulnerability has been resolved:

net/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LINK transition

When smc_llc_event_handler() transitions the local LLC flow from SMC_LLC_FLOW_REQ_ADD_LINK to SMC_LLC_FLOW_ADD_LINK on arrival of an ADD_LINK request, it calls smc_llc_flow_qentry_set() unconditionally:

if (lgr->llc_flow_lcl.type == SMC_LLC_FLOW_REQ_ADD_LINK) {
    lgr->llc_flow_lcl.type = SMC_LLC_FLOW_ADD_LINK;
    smc_llc_flow_qentry_set(&lgr->llc_flow_lcl, qentry);
    ...
}

A CONFIRM_LINK or ADD_LINK_CONT arriving while flow->type is SMC_LLC_FLOW_REQ_ADD_LINK is stashed into flow->qentry via the SMC_LLC_CONFIRM_LINK / SMC_LLC_ADD_LINK_CONT handler (which stores into flow->qentry for any non-NONE flow type). When the subsequent ADD_LINK arrives, the REQ_ADD_LINK branch overwrites flow->qentry with the new pointer without first freeing the stashed allocation, leaking one kmalloc object.

The stashed entry has no consumer: smc_llc_wait() is only called from llc_add_link_work, which is not yet scheduled while the flow type remains REQ_ADD_LINK. No waiter is sleeping on llc_msg_waiter at this point. It is safe to unconditionally free any stashed qentry before the overwrite.

Call smc_llc_flow_qentry_del() before smc_llc_flow_qentry_set() in the REQ_ADD_LINK branch. smc_llc_flow_qentry_del() already checks flow->qentry before freeing, so the normal path where no entry is stashed is a no-op.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2026-90108"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-17T17:17:02Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LINK transition\n\nWhen smc_llc_event_handler() transitions the local LLC flow from\nSMC_LLC_FLOW_REQ_ADD_LINK to SMC_LLC_FLOW_ADD_LINK on arrival of an ADD_LINK\nrequest, it calls smc_llc_flow_qentry_set() unconditionally:\n\n\tif (lgr-\u003ellc_flow_lcl.type == SMC_LLC_FLOW_REQ_ADD_LINK) {\n\t\tlgr-\u003ellc_flow_lcl.type = SMC_LLC_FLOW_ADD_LINK;\n\t\tsmc_llc_flow_qentry_set(\u0026lgr-\u003ellc_flow_lcl, qentry);\n\t\t...\n\t}\n\nA CONFIRM_LINK or ADD_LINK_CONT arriving while flow-\u003etype is\nSMC_LLC_FLOW_REQ_ADD_LINK is stashed into flow-\u003eqentry via the\nSMC_LLC_CONFIRM_LINK / SMC_LLC_ADD_LINK_CONT handler (which stores into\nflow-\u003eqentry for any non-NONE flow type).  When the subsequent ADD_LINK\narrives, the REQ_ADD_LINK branch overwrites flow-\u003eqentry with the new pointer\nwithout first freeing the stashed allocation, leaking one kmalloc object.\n\nThe stashed entry has no consumer: smc_llc_wait() is only called from\nllc_add_link_work, which is not yet scheduled while the flow type remains\nREQ_ADD_LINK.  No waiter is sleeping on llc_msg_waiter at this point.\nIt is safe to unconditionally free any stashed qentry before\nthe overwrite.\n\nCall smc_llc_flow_qentry_del() before smc_llc_flow_qentry_set() in the\nREQ_ADD_LINK branch.  smc_llc_flow_qentry_del() already checks flow-\u003eqentry\nbefore freeing, so the normal path where no entry is stashed is a no-op.",
  "id": "GHSA-6x7f-mrc2-297f",
  "modified": "2026-09-17T18:31:51Z",
  "published": "2026-09-17T18:31:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-90108"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/036322025d6e440cb75fc6fecbba9a16b271a2ae"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/056395acb7041b3a1f2baa08d89a1938a8b8776a"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0fb9a513766071ea9d5f3bf988e39241b8e9ee3b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7dd55348c0d9399a9448847819e9f3904ae507ad"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b08aacfb226a840628151643b6a34eecf545d311"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e25a602c45c76a7130878db72bcf6f76df04bf85"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.