# CVE-2026-90171: smb: smbdirect: release pending child sockets outside the handler lock

> A use-after-free in the Linux kernel's SMB Direct module can cause a system crash during listener shutdown, requiring high privileges to trigger.

- **Severity:** Not scored
- **Exploited in the wild:** Not known
- **Login needed:** An administrator
- **Attackable:** Local or same network only
- **Victim action needed:** Not needed
- **Fix available:** Yes
- **Published:** 17 Sep 2026
- **Updated:** 19 Oct 2026
- **Also known as:** DEBIAN-CVE-2026-90171, GHSA-f5r6-6w97-7r58, UBUNTU-CVE-2026-90171

## What is CVE-2026-90171?

CVE-2026-90171 is an use after free vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.

### Official description

In the Linux kernel, the following vulnerability has been resolved:

smb: smbdirect: release pending child sockets outside the handler lock

smbdirect_socket_destroy() releases the listener's pending/ready child
sockets while still holding the listener's handler lock, the
&id_priv->handler_mutex taken via rdma_lock_handler(), not
sc->listen.lock, and before the listener's own rdma_destroy_id().
That ordering has one real consequence and one cosmetic one.

The real one: smbdirect_socket_release() drops the child's last
reference, which destroys the child's cm_id.  Doing that before the
listener's rdma_destroy_id() lets _cma_cancel_listens(), running from
the listener's _destroy_id(), walk an already freed child id_priv,
which KASAN catches as a slab-use-after-free during listener shutdown:

[ 4758.909130] BUG: KASAN: slab-use-after-free in __mutex_lock+0x1469/0x1560
[ 4758.911450] Read of size 1 at addr ffff88821c381db4 by task ksmbd.control/1652
[ 4758.913262] Call Trace:
[ 4758.913267]  <TASK>
[ 4758.913299]  __mutex_lock+0x1469/0x1560
[ 4758.913408]  _cma_cancel_listens+0x312/0x3b0
[ 4758.913413]  _destroy_id+0x363/0xee0
[ 4758.913417]  smbdirect_socket_destroy_sync+0x17d5/0x2440
[ 4758.913443]  smbdirect_socket_release+0x124/0x230
[ 4758.913451]  ksmbd_rdma_stop_listening+0x9f/0x190
[ 4758.913457]  ksmbd_conn_transport_destroy+0x65/0x3c0
[ 4758.913463]  kill_server_store+0x1fb/0x2b0
[ 4758.913501]  kernfs_fop_write_iter+0x349/0x4d0
[ 4758.913507]  vfs_write+0x5e7/0xc70
[ 4758.913528]  ksys_write+0x12a/0x210
[ 4758.913541]  do_syscall_64+0x135/0x460
[ 4758.913555]  entry_SYSCALL_64_after_hwframe+0x77/0x7f

The cosmetic one: releasing a child recurses into
smbdirect_socket_destroy(), which takes the child's own
rdma_lock_handler() lock nested under the listener's.  The listener's
and the child's cm_id are always different instances, so this cannot
deadlock for real; the CM core itself nests a new connection id's
handler_mutex under the listening id's in cma_ib_req_handler().  But
lockdep only sees one lock class, reports possible recursive locking,
and then disables itself, hiding real locking bugs for the rest of the
run:

[ 2424.579653] WARNING: possible recursive locking detected
[ 2424.581180] 7.1.0-next-20260623+ #89 Not tainted
[ 2424.582548] --------------------------------------------
[ 2424.584500] ksmbd.control/8854 is trying to acquire lock:
[ 2424.586817] ffff888102303c20 (&id_priv->handler_mutex){+.+.}-{4:4}, at: smbdirect_socket_destroy_sync+0xc39/0x2440
[ 2424.590590]
[ 2424.590590] but task is already holding lock:
[ 2424.591601] ffff888102046c20 (&id_priv->handler_mutex){+.+.}-{4:4}, at: smbdirect_socket_destroy_sync+0xc39/0x2440
[ 2424.594178]
[ 2424.594178] other info that might help us debug this:
[ 2424.596634]  Possible unsafe locking scenario:
[ 2424.596634]
[ 2424.598841]        CPU0
[ 2424.599765]        ----
[ 2424.600695]   lock(&id_priv->handler_mutex);
[ 2424.601836]   lock(&id_priv->handler_mutex);
[ 2424.602590]
[ 2424.602590]  *** DEADLOCK ***
[ 2424.602590]
[ 2424.604512]  May be due to missing lock nesting notation

Splice the pending/ready children onto a local list under the
listener's listen.lock, while the handler lock is held so a concurrent
CM CONNECT_REQUEST cannot add more, but defer the actual
smbdirect_socket_release() calls until after the listener's cm_id has
been destroyed and its handler lock dropped.  The children are
independent sockets whose teardown needs neither the listener's
handler lock nor its cm_id.

Found with ksmbdzzer [2], a KSMBD fuzzer that drives libFuzzer with a
kcov-dataflow [1] coverage vector: it folds each instrumented
comparison/argument's runtime operand value together with its PC (the
default arm mixes them as pc⊕val) so that a new operand value at a known
site counts as new coverage.

[1] https://lwn.net/Articles/1077606/
[2] https://github.com/yskzalloc/kcov-dataflow

## Which versions are affected by CVE-2026-90171?


## How do I fix CVE-2026-90171?

Apply the vendor's patch.

## Is CVE-2026-90171 being exploited?

There is no known exploitation of CVE-2026-90171 in the wild and no public exploit code.

## Fix prompt for AI coding agents

```text
Check this codebase for CVE-2026-90171 and fix it if it is affected.

What it is: CVE-2026-90171 is an use after free vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Exploitation: There is no known exploitation of CVE-2026-90171 in the wild and no public exploit code.

Affected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.

Task:
1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.
2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.
3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.
4. Run the tests and summarise what changed and why.
5. If nothing in the project is affected, say so and change nothing.

Reference: https://insights.sbomify.com/CVE-2026-90171/ (Markdown: https://insights.sbomify.com/CVE-2026-90171/index.md)
```

## Sources

- CVE record: https://www.cve.org/CVERecord?id=CVE-2026-90171
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-90171
- OSV: https://osv.dev/vulnerability/CVE-2026-90171

---
From sbomify Insights: https://insights.sbomify.com/CVE-2026-90171/
Summaries are generated and may contain mistakes; the official description above is the record.