CVE-2026-90172
Description
A flaw was found in the Linux kernel's smbdirect module, which handles high-performance data transfer using Remote Direct Memory Access (RDMA). During an RDMA connection attempt, if the connection acceptance fails, the system incorrectly deallocates memory resources before all related operations are finalized. This can lead to a NULL-pointer dereference, causing the system to crash and resulting in a Denial of Service (DoS).
Statement
An incorrect teardown order in the SMB Direct accept failure path can destroy the receive memory pool and slab cache while a posted recv_io object is still owned by the RDMA QP. Draining the QP later invokes the receive completion and returns that object through already destroyed allocation infrastructure, producing allocator warnings, BAD_PAGE state, and a NULL pointer dereference in mempool_free_bulk. A remote RDMA peer may potentially reach this path before SMB authentication by initiating an SMB Direct connection that fails during RDMA acceptance. For the CVSS the PR:N is used because the peer does not need an authenticated account or privileges on the target when the SMB Direct listener is reachable. AV:A and AC:H are used because access normally requires adjacency to the RDMA fabric and reliable triggering depends on an accept failure after the receive object has been posted. The demonstrated impact is a kernel crash and denial of service. SMB Direct is normally limited to trusted data center or storage networks and is rarely exposed to the public Internet.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | 7.5 |
| Attack Vector | Adjacent Network | N/A | Network |
| Attack Complexity | High | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Integrity,Confidentiality
Technical Impact: Modify Application Data; Read Application Data
If a released resource is subsequently reused or reallocated, then an attempt to use the original resource might allow access to sensitive data that is associated with a different user or entity.
Other,Availability
Technical Impact: Other; DoS: Crash, Exit, or Restart
When a resource is released it might not be in an expected state, later attempts to access the resource may lead to resultant errors that may lead to a crash.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
