[CVE-2026-90172][MODERATE 7.0] smb: smbdirect: destroy QP before mem pools on accept failure [ Upstream

[CVE-2026-90172][MODERATE 7.0] smb: smbdirect: destroy QP before mem pools on accept failure [ Upstream

[AL-KERNEL]

CVE: CVE-2026-90172
Priority: MODERATE 7.0
AL-KERNEL base severity: MODERATE
KPANIC flag: YES
Patch: smb: smbdirect: destroy QP before mem pools on accept failure [ Upstream
Commit: 959813a3752b459ed77b0b3eaf30b9f4c6204260
Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=959813a3752b459ed77b0b3eaf30b9f4c6204260
Original CVE announcement: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-90172
Analysis date: Thu, 17 Sep 2026 22:44:24 -0400
ActionableScore: 5
ActionableScore lower bound: 3
Actionable bucket: Actionable Moderate
Manual review required: NO

Summary:
No one-sentence report phrase was found.

======================================================================
ABOUT THIS REPORT
======================================================================

The original Linux kernel CVE announcement for CVE-2026-90172 is available here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-90172

The original announcement does not normally provide a security severity
estimate, CVSS assessment, or enough information to determine whether the
reported kernel bug represents a practically relevant security issue.

This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin. It combines
an autonomous classifier with LLM-assisted technical analysis and a
separate ActionableScore mechanism.

The purpose of this report is to prioritize Linux kernel CVEs before
manual review, identify cases that require prompt investigation, and
support automatic closure of issues that are unlikely to have meaningful
security impact.

Published priority for this report: MODERATE 7.0
Manual review required: NO

A detailed explanation of the methodology and priority rules is included
at the end of this message.

======================================================================
AL-KERNEL CLASSIFICATION RESULT
======================================================================

CVE-2026-90172	MODERATE	https://www.kernelcve.org/list/?q=CVE-2026-90172 CHECK WITH IMPACT FROM ORIG NN NONE	Maybe valid. Check manually. Hints by AL-KERNEL: The best (paranoid) CVSS is 'AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H';*CWE-672;*CWE-416;**CWE-476;Other CVSS 'AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H';BEST CVSS score: '7.5';DESCR 'An incorrect teardown order in the SMB Direct accept failure path can destroy the receive memory pool and slab cache while a posted recv_io object is still owned by the RDMA QP. Draining the QP later invokes the receive completion and returns that object through already destroyed allocation infrastructure, producing allocator warnings, BAD_PAGE state, and a NULL pointer dereference in mempool_free_bulk. A remote RDMA peer may potentially reach this path before SMB authentication by initiating an SMB Direct connection that fails during RDMA acceptance. For the CVSS the PR:N is used because the peer does not need an authenticated account or privileges on the target when the SMB Direct listener is reachable. AV:A and AC:H are used because access normally requires adjacency to the RDMA fabric and reliable triggering depends on an accept failure after the receive object has been posted. The demonstrated impact is a kernel crash and denial of service. The object lifetime violation and asynchronous completion into destroyed allocator infrastructure also create a potential UAF condition that may have confidentiality or integrity consequences and requires manual analysis. SMB Direct is normally limited to trusted data center or storage networks and is rarely exposed to the public Internet.';YES REQUIRES MANUAL CHECK; ,and ActionableScore result is Actionable Moderate (with actual score 4)  SKIP CVE-2026-90172 UNKNOWN SKIP The Fixes patch not applied yet, so unlikely that actual: url YES  NO NO unknown 	MAYBE	REMOTE NULLPTR DISK INIT ERRORPATH UAF SKIP KERNEL_PANIC_PLUS_UAF HARDWARE LINUS  KPANIC INCREASED_TO_MODERATE7_FROM_LOW_BASED_ON_GUESSCVSS_AND_ACTIONABLESCOREHIGHER4	-	-	checked

======================================================================
ACTIONABLESCORE ANALYSIS
======================================================================

ActionableScore=5
ActionableScoreLower=3
PrimitiveClass=CLASS_B
RealUAF=YES
HostAdminRequired=UNKNOWN
NamespaceScopedPrivilege=UNKNOWN
ImportantCandidate=NO
ManualReview=RECOMMENDED
AutoDowngradeAllowed=YES

1. ActionableScore

* Raw conservative score: 3
* Conservative score: 3
* Raw paranoid score: 5
* Paranoid score: 5
* No floor or cap was applied.
* Final recommended bucket: **Actionable Moderate**::

2. Signal breakdown

Conservative signals:

* +2 Real UAF or lifetime violation. A posted `recv_io` remains owned by the QP after its backing mempool and slab infrastructure are destroyed. The later QP drain invokes a completion that returns the object through post-lifetime allocation state.
* +1 Reliable kernel crash or strong DoS. The supplied trace and commit establish allocator warnings, `BAD_PAGE`, and a NULL-pointer dereference in `mempool_free_bulk`.
* Total: 3.

Additional paranoid signal:

* +2 Direct network reachability. An inbound RDMA connection request enters this pre-authentication SMB Direct accept path. This is defensible when an attacker can cause or coincide with the required `rdma_accept()` failure on an exposed listener, but exact attacker control over that failure is not fully established.
* Total: 5.

Not awarded:

* No strong exploitation leverage. Controlled reclaim, attacker-shaped replacement contents, callback control, directed write, and arbitrary read or write are not demonstrated.
* No structured stale-object leverage. The stale operation is confined to accept-failure teardown and returns a fixed outstanding receive object through destroyed pool infrastructure.
* No active-object lifetime-manipulation bonus. Recreating failed connections is not evidence that the attacker controls reuse or post-free contents.
* No concrete repeated release or refcount bonus. The sequence is not two lifetime mutations on the exact same dangling object.
* No paranoid repeated-refcount bonus and no FLOOR 5 from that rule.
* No confidentiality or integrity points. The proposed paranoid CVSS C:H and I:H are not supported by an independent disclosure or modification primitive.
* No extra Availability point. The allocator failure and NULL dereference describe the same crash consequence.
* No race penalty. This is an ordered error-path teardown defect, not a demonstrated narrow timing race.
* No rare-hardware penalty. The report was reproduced under QEMU, so physical-only or uncommon hardware is not established.

3. Reachability analysis

The vulnerable function is reached from the RDMA CM workqueue while accepting an inbound SMB Direct connection. The request is processed before SMB authentication, so a peer does not appear to need an SMB account once a reachable SMB Direct listener exists.

The complete trigger additionally requires a successfully posted receive followed by failure of `rdma_accept()`. The supplied evidence does not prove that a remote peer can deterministically force that failure, so below-host-admin reachability for the complete sequence remains unresolved. Therefore `HostAdminRequired=UNKNOWN`, not YES or NO.

A host administrator must first enable and expose KSMBD SMB Direct and provide a usable RDMA transport. This is prior privileged service setup, but it does not mean the connecting peer has host privileges. No evidence establishes a complete attacker-created namespace path, so `NamespaceScopedPrivilege=UNKNOWN`.

The path is network-adjacent through an RDMA fabric rather than broadly Internet-routable. No hard race is required. The uncertainty concerns control over the accept failure, not a narrow interleaving.

4. Primitive and severity interpretation

The exact primitive is an asynchronous post-teardown lifetime violation. The QP still owns a fixed `recv_io` when the connection mempool and receive slab infrastructure are destroyed. Draining the QP later runs the completion and attempts to return that object through already-destroyed pool state.

This is a real Class B lifetime violation, not merely passive bookkeeping. It is nevertheless a constrained cleanup-path UAF rather than a demonstrated active-object exploitation primitive. The stale use leads into allocator cleanup and an observed NULL dereference. No useful post-reuse field consumption, controlled replacement, repeated refcount mutation, or non-crash security effect is established.

The demonstrated consequence is host kernel DoS. Confidentiality impact, integrity impact, and privilege escalation remain theoretical and are not scored. `ImportantCandidate=NO` because the evidence supports a constrained crash-oriented Class B case without meaningful unresolved exploitation leverage. `AutoDowngradeAllowed=YES` because no concrete reuse, write, disclosure, boundary-bypass, or repeated lifetime-mutation primitive remains unresolved.

Likely operational severity is Actionable Moderate when remote influence over the accept-failure condition is credible. Without that reachability, it is a borderline crash-only lifetime bug.

5. One-sentence report phrase

An SMB Direct accept failure can destroy receive allocation pools before draining the RDMA QP, causing a posted receive completion to use destroyed pool state and crash the kernel.

6. Manual review recommendation

MANUAL CHECK RECOMMENDED

Confirm whether an unauthenticated RDMA peer can reliably force or influence the required `rdma_accept()` failure on affected KSMBD configurations.

7. Call-site confidence

Call-site confidence: high

======================================================================
UPSTREAM PATCH SUMMARY
======================================================================

Patch: smb: smbdirect: destroy QP before mem pools on accept failure [ Upstream
Commit: 959813a3752b459ed77b0b3eaf30b9f4c6204260
Upstream URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=959813a3752b459ed77b0b3eaf30b9f4c6204260

Changed files:
  mm/slub.c
  mm/slab_common.c
  fs/smb/smbdirect/accept.c

Diff excerpt:

Not included in this email. See the upstream URL for the full patch.

Full patch:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=959813a3752b459ed77b0b3eaf30b9f4c6204260

======================================================================
DETAILED REPORT METHODOLOGY
======================================================================

The original Linux kernel CVE announcement for CVE-2026-90172 can be found here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-90172

The original CVE announcement normally does not include a security-level
estimate. In particular, it may not contain a CVSS assessment, an impact
level, or enough information to determine whether the reported bug is a
practically relevant security issue. One purpose of this parallel CVE list
is to provide that missing technical and prioritization information.

The original goal of the AL-KERNEL project was to prioritize Linux kernel
CVE analysis automatically before manual review. The system can also help
identify non-security issues that may be suitable for automatic closure.

This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin.

The first analysis stage combines an autonomous classifier with additional
LLM-based analysis. The autonomous classifier runs locally on a CPU and is
based on a backpropagation neural network. Together, these mechanisms
produce a technical vulnerability description, identify likely weakness
types, estimate CVSS severity, and provide input for ActionableScore.

Two CVSS estimates are retained because incomplete kernel vulnerability
information often permits more than one defensible interpretation:

  Conservative CVSS vector: AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
  The Best / paranoid CVSS vector: AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
  The Best / paranoid CVSS score: 7.5

The conservative vector represents a lower-impact interpretation.
The Best/paranoid vector intentionally represents a plausible upper-bound
interpretation and should not automatically be treated as demonstrated
real-world impact.

CVSS may also need to be adjusted for a particular Linux deployment,
because actual reachability, privileges, enabled kernel configuration,
hardware, namespaces, exposed device nodes, and other environmental
conditions can differ significantly between systems.

A separate ActionableScore mechanism evaluates practical remediation
urgency. Its analysis may include reachability, attack prerequisites,
subsystem exposure, memory-corruption characteristics, denial-of-service
reliability, and possible confidentiality, integrity, or
privilege-escalation impact.

  Conservative ActionableScore: 3
  Paranoid ActionableScore: 5

The final base severity is taken directly from the second tab-separated
field of the AL-KERNEL classification result. ActionableScore does not
replace or independently override that final AL-KERNEL decision, and
if ActionableScore adjusted impact level of ALKERNEL, then you would see
self-readable flags above like INCREASED_TO_HIGH_BASED_ON_ACTIONABLESCOREHIGHEREQTHAN7.

For an AL-KERNEL result of MODERATE, this report uses the following
additional presentation split:

  ActionableScore below 5   -> MODERATE REGULAR
  ActionableScore 5 or more -> MODERATE 7.0

The distinction between MODERATE REGULAR and MODERATE 7.0 makes it
possible to identify Moderate issues that should receive manual analysis
and fixes before lower-priority MODERATE REGULAR issues. In many cases,
MODERATE REGULAR fixes may wait for a later rebase or routine update.

There is one override in which MODERATE REGULAR becomes MODERATE 7.0
even when the ActionableScore is below 5. When the AL-KERNEL result
contains the KPANIC flag, a MODERATE result is always presented as
MODERATE 7.0. The KPANIC flag selected with few regexps without
usage of AI at all, so it helps to detect cases when Kernel Crash happens
and similar (to filter False-Negative results from the LLM usage).

KPANIC indicates that a reliable kernel crash, kernel panic, or similarly
serious kernel availability impact was identified by the classification
workflow.

AL-KERNEL base severity for this report: MODERATE
KPANIC detected for this report: YES
Published priority for this report (same as in Subject): MODERATE 7.0

These results are intended to support engineering triage. They are
machine-generated estimates, and cases marked for manual review should
be validated by a human security engineer before final disposition.
For more info read docs linked from here: https://kernelcve.org/
(and you can submit you own patch there to generate such a report
for non-existant CVE-id yet).

Note that in many cases this AI tool selects higher severity, than
real is (means you can expect Importants instead of Moderate 7.0 or
Moderates 7.0 instead of regular Moderates). If you see such cases,
please use reply email interface to add additional manual analyses
info to this particular CVE.
And please, please, let me know when you see Lows instead of Importants
or Important instead of Low (because particular for such cases I
need to tune this AI tool to make it better for this one and next similar).
My contact email for such notifications is alexanjelausa@gmail.com (and both
send reply to CVE record itself too and see "reply" button below for howto reply).