{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-90172 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-90172 is a high-severity use after free vulnerability in Linux, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-90172 and fix it if it is affected.\n\nWhat it is: CVE-2026-90172 is a high-severity use after free vulnerability in Linux, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-90172 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-90172/ (Markdown: https://insights.sbomify.com/CVE-2026-90172/index.md)","id":"CVE-2026-90172","markdown":"https://insights.sbomify.com/CVE-2026-90172/index.md","name":"CVE-2026-90172","record":{"aliases":["DEBIAN-CVE-2026-90172","GHSA-pqj5-pgr6-pmv4","UBUNTU-CVE-2026-90172"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Linux kernel SMB","requires_auth":"none","summary":"A use-after-free vulnerability in the Linux kernel's SMB Direct module allows a local attacker to cause a system crash via a NULL pointer dereference.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":7.5,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nsmb: smbdirect: destroy QP before mem pools on accept failure\n\nOn the rdma_accept_failed error path of\nsmbdirect_accept_connect_request(), the receive io posted just above is\nowned by the QP (recv_io is set to NULL after a successful post).  The\nerror path fell through to smbdirect_connection_destroy_mem_pools()\nbefore smbdirect_connection_destroy_qp(), so the mem pools and the\nrecv_io slab cache were destroyed while that recv_io was still\noutstanding on the QP.\n\nThe drain in smbdirect_connection_destroy_qp() (ib_drain_qp()) is what\nruns the recv completion that returns the recv_io to the free list, so\ndestroying the pools first leaves the object outstanding at\nkmem_cache_destroy() time (\"Slab cache still has objects\") and later\nfrees it into an already-destroyed mempool (mempool_free_bulk\nNULL-pointer dereference).\n\nGive rdma_accept_failed its own teardown that drains the QP first, then\ndestroys the mem pools, and returns.  The remaining labels\n(post_recv_io_failed onward) run before the recv_io was ever posted, so\nthey keep the mem-pools-then-qp order.\n\nThe outstanding recv_io at kmem_cache_destroy() time:\n\n[ 3487.344647] =============================================================================\n[ 3487.349942] BUG smbdirect_recv_io_cache_ffff88811ba99000 (Not tainted): Objects remaining on __kmem_cache_shutdown()\n[ 3487.356078] -----------------------------------------------------------------------------\n[ 3487.356078]\n[ 3487.356738] Object 0xffff8881511c3440 @offset=13376\n[ 3487.358464] Allocated in mempool_alloc_noprof+0x18c/0x290 age=1194 cpu=6 pid=22254\n[ 3487.361197]  mempool_alloc_noprof+0x18c/0x290\n[ 3487.361542]  smbdirect_connection_create_mem_pools+0x405/0x780\n[ 3487.361972]  smbdirect_accept_connect_request+0x5a8/0x1b80\n[ 3487.362359]  smbdirect_listen_rdma_event_handler+0x1579/0x1b90\n[ 3487.362779]  cma_cm_event_handler+0x9c/0x230\n[ 3487.363096]  cma_ib_req_handler+0x2682/0x45d0\n[ 3487.363414]  cm_process_work+0x56/0x3d0\n[ 3487.363676]  cm_work_handler+0x8a0e/0xd000\n[ 3487.367496]  process_scheduled_works+0xa07/0x13a0\n[ 3487.367859]  worker_thread+0x7c9/0xc80\n[ 3487.368148]  kthread+0x341/0x430\n[ 3487.368407]  ret_from_fork+0x3a8/0x7a0\n[ 3487.368704]  ret_from_fork_asm+0x1a/0x30\n[ 3487.370307] Slab 0xffffea0005447000 objects=19 used=1 fp=0xffff8881511c0040 flags=0x100000000000240(workingset|head|node=0|zone=2)\n[ 3487.372840] ------------[ cut here ]------------\n[ 3487.373195] WARNING: mm/slub.c:1244 at __slab_err+0x1a/0x30, CPU#6: kworker/6:84/22254\n[ 3487.373759] Modules linked in:\n[ 3487.373993] CPU: 6 UID: 0 PID: 22254 Comm: kworker/6:84 Tainted: G    B               7.1.0-next-20260623+ #88 PREEMPT(lazy)\n[ 3487.374778] Tainted: [B]=BAD_PAGE\n[ 3487.377830] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014\n[ 3487.378515] Workqueue: ib_cm cm_work_handler\n[ 3487.378820] RIP: 0010:__slab_err+0x1a/0x30\n[ 3487.379129] Code: 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 44 00 00 e8 36 00 00 00 bf 05 00 00 00 be 01 00 00 00 e8 f7 75 45 00 90 \u003c0f\u003e 0b 90 c3 cc cc cc cc cc 66 66 66 66 2e 0f 1f 84 00 00 00 00 00\n[ 3487.383255] RSP: 0018:ffff888220fc7050 EFLAGS: 00010093\n[ 3487.383643] RAX: ffffffff8168e60a RBX: ffff88810955e640 RCX: ffff88821c381d80\n[ 3487.384158] RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffffffff870fa080\n[ 3487.384662] RBP: ffff888220fc7068 R08: ffffffff870fa087 R09: 1ffffffff0e1f410\n[ 3487.385192] R10: dffffc0000000000 R11: fffffbfff0e1f411 R12: ffffea0005447210\n[ 3487.385674] R13: ffffea0005447000 R14: ffff888220fc7068 R15: ffff88812a8ab300\n[ 3487.388932] FS:  0000000000000000(0000) GS:ffff888427e76000(0000) knlGS:0000000000000000\n[ 3487.389529] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 3487.389934] CR2: 00007ffcf2d84fd8 CR3: 0000000111d64006 CR4: 0000000000f72ef0\n[ 3487.390440] PKRU: 55555554\n[ 3487.390641] Call Trace:\n[ 3487.390826]  \u003cTASK\u003e\n[ 3\n---truncated---","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"smb: smbdirect: destroy QP before mem pools on accept failure","id":"CVE-2026-90172","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":2,"next":{"headline":"smb: smbdirect: free completion queues with ib_free_cq()","id":"CVE-2026-90173"},"packages":[],"prev":{"headline":"smb: smbdirect: release pending child sockets outside the handler lock","id":"CVE-2026-90171"},"products":["Linux"],"published":"2026-09-17","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A use-after-free vulnerability in the Linux kernel's SMB Direct module allows a local attacker to cause a system crash via a NULL pointer dereference.","url":"https://insights.sbomify.com/CVE-2026-90172/"}