CVE-2026-90171

CVE-2026-90171 is a slab-use-after-free in the Linux kernel's KSMBD RDMA transport (smb: smbdirect). During listener shutdown, smbdirect_socket_destroy() releases pending child sockets while still holding the listener's handler_mutex and before the listener's own rdma_destroy_id(). This causes _c...

CVE-2026-90171 smb: smbdirect: release pending child sockets outside the handler lock

In the Linux kernel, the following vulnerability has been resolved: smb: smbdirect: release pending child sockets outside the handler lock smbdirectsocketdestroy releases the listener's pending/ready child sockets while still holding the listener's handler lock, the &idpriv-handlermutex taken via...