CVE-2026-90108

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/smc: free stashed qentry before overwrite in REQ_ADD_LINK to ADD_LINK transition

When smc_llc_event_handler() transitions the local LLC flow from

SMC_LLC_FLOW_REQ_ADD_LINK to SMC_LLC_FLOW_ADD_LINK on arrival of an ADD_LINK

request, it calls smc_llc_flow_qentry_set() unconditionally:

if (lgr->llc_flow_lcl.type == SMC_LLC_FLOW_REQ_ADD_LINK) {

lgr->llc_flow_lcl.type = SMC_LLC_FLOW_ADD_LINK;

smc_llc_flow_qentry_set(&lgr->llc_flow_lcl, qentry);

...

}

A CONFIRM_LINK or ADD_LINK_CONT arriving while flow->type is

SMC_LLC_FLOW_REQ_ADD_LINK is stashed into flow->qentry via the

SMC_LLC_CONFIRM_LINK / SMC_LLC_ADD_LINK_CONT handler (which stores into

flow->qentry for any non-NONE flow type). When the subsequent ADD_LINK

arrives, the REQ_ADD_LINK branch overwrites flow->qentry with the new pointer

without first freeing the stashed allocation, leaking one kmalloc object.

The stashed entry has no consumer: smc_llc_wa

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References