CVE-2026-90172 Linux CVE debrief

Who should care

Linux kernel developers, administrators, and users of SMBDirect should assess exposure and prioritize verification of affected systems, especially those using SMBDirect. Verify Linux kernel version and apply patch if necessary to prevent potential slab cache errors. Assess exposure and prioritize verification of affected systems, especially those using SMBDirect.

Why it matters

A vulnerability in the Linux kernel's SMBDirect implementation can cause a slab cache object to be outstanding at kmem_cache_destroy() time, leading to potential errors. Linux kernel developers and administrators should assess exposure and prioritize verification of affected systems.

• Verify Linux kernel version and apply patch if necessary to prevent potential slab cache errors.
• Monitor system logs for errors related to SMBDirect implementation.
• Assess exposure and prioritize verification of affected systems, especially those using SMBDirect.

Technical summary

The vulnerability occurs in the Linux kernel's SMBDirect implementation, specifically in the smbdirect_accept_connect_request() function. When the rdma_accept_failed error path is executed, the memory pools are destroyed before the QP is drained, leading to a potential slab cache object being outstanding at kmem_cache_destroy() time. This results in a slab cache object being outstanding at kmem_cache_destroy() time, causing a 'Slab cache still has objects' error and a potential NULL-pointer dereference when freeing the object into an already-destroyed mempool. The issue is caused by the order of operations in the error path of smbdirect_accept_connect_request(). The QP must be drained before destroying the to

Defensive priority

Linux kernel developers and administrators should assess exposure and prioritize verification of affected systems, especially those using SMBDirect.

Recommended defensive actions

• Review and verify the Linux kernel version used in your systems to determine if it is affected by this vulnerability.
• Apply the patch provided in the Linux kernel repository to resolve the issue.
• Monitor system logs for potential errors related to the SMBDirect implementation.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The issue is caused by the order of operations in the error path of smbdirect_accept_connect_request(). The QP must be drained before destroying the memory pools to prevent the slab cache object from being outstanding.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.