CVE-2026-90173 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux kernel-based systems should assess their exposure to this vulnerability and apply the provided patches or monitor for updates.

Why it matters

A use-after-free vulnerability in the Linux kernel's smbdirect implementation can lead to potential remote code execution or denial-of-service attacks. Linux kernel developers and maintainers should assess their exposure and apply the provided patches or monitor for updates.

• Potential remote code execution or denial-of-service attacks against Linux kernel-based systems.
• Verification of Linux kernel versions and patch application is necessary to prevent exploitation.
• Exposure assessment and patch application are crucial for Linux kernel developers and maintainers.

Technical summary

The vulnerability is caused by the incorrect destruction of completion queues in the smbdirect implementation. When a completion is posted late, it can lead to a use-after-free error in ib_cq_poll_work(). The fix involves using ib_free_cq() instead of ib_destroy_cq() to properly cancel the poll work before freeing the completion queue. This change ensures that no completion handler can run against a freed queue, preventing potential remote code execution or denial-of-service attacks. Linux kernel developers and maintainers should review and apply the provided patches to address this vulnerability.

Defensive priority

High

Recommended defensive actions

• Review and apply the provided patches to ensure the smbdirect implementation uses ib_free_cq() for completion queue destruction.
• Monitor Linux kernel updates for potential backports of the fix.
• Assess the exposure of Linux kernel-based systems to this vulnerability.
• Verify Linux kernel versions and apply patches or mitigations as needed.
• Track exceptions and retest remediated assets to ensure the vulnerability is properly addressed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Review compensating controls for exposed systems while remediation is scheduled and verified.

Evidence notes

The vulnerability was introduced due to the incorrect destruction of completion queues in the smbdirect implementation. The fix involves using ib_free_cq() instead of ib_destroy_cq() to properly cancel the poll work before freeing the completion queue.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.