CVE-2026-90173: smb: smbdirect: free completion queues with ib_free_cq()

CVE-2026-90173: smb: smbdirect: free completion queues with ib_free_cq()

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

smb: smbdirect: free completion queues with ib_free_cq()

smbdirect_connection_destroy_qp() creates the send and receive completion
queues with ib_alloc_cq_any(), which for IB_POLL_WORKQUEUE arms an
internal completion handler that runs ib_cq_poll_work() on a workqueue.
Tearing those CQs down with ib_destroy_cq() frees them without first
cancelling that poll work.

If the provider posts a completion late -- for example Soft-RoCE (rxe)
posting an RNR error from rxe_receiver() after rdma_destroy_qp() -- the
handler re-queues ib_cq_poll_work() on the already-freed CQ, and a
follow-on access faults in rxe_req_notify_cq().

Use ib_free_cq(), which cancel_work_sync()es the poll work before freeing
the CQ, so no completion handler can run against a freed queue.

[ 1236.599526] ==================================================================
[ 1236.602142] BUG: KASAN: slab-use-after-free in ib_cq_poll_work+0xd0/0x1a0
[ 1236.605524] Read of size 8 at addr ffff888111865800 by task kworker/4:1H/82
[ 1236.609017]
[ 1236.609270] CPU: 4 UID: 0 PID: 82 Comm: kworker/4:1H Not tainted 7.2.0-rc3-next-20260717-virtme #110 PREEMPT(lazy)
[ 1236.609287] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014
[ 1236.609498] Workqueue: ib-comp-wq ib_cq_poll_work
[ 1236.609525] Call Trace:
[ 1236.609536]  <TASK>
[ 1236.609545]  __dump_stack+0x21/0x60
[ 1236.609562]  dump_stack_lvl+0xc2/0x100
[ 1236.609573]  print_address_description+0x77/0x200
[ 1236.609587]  ? ib_cq_poll_work+0xd0/0x1a0
[ 1236.609597]  print_report+0x58/0x70
[ 1236.609607]  kasan_report+0x117/0x150
[ 1236.609623]  ? ib_cq_poll_work+0xd0/0x1a0
[ 1236.609636]  ? process_scheduled_works+0x954/0x1600
[ 1236.609650]  ib_cq_poll_work+0xd0/0x1a0
[ 1236.609662]  ? process_scheduled_works+0x954/0x1600
[ 1236.609674]  process_scheduled_works+0xc22/0x1600
[ 1236.609698]  ? __pfx_process_scheduled_works+0x10/0x10
[ 1236.609713]  ? __pfx_assign_work+0x10/0x10
[ 1236.609726]  ? lock_is_held_type+0x7b/0x110
[ 1236.609741]  worker_thread+0x975/0xee0
[ 1236.609757]  ? __pfx_do_raw_spin_lock+0x10/0x10
[ 1236.609775]  ? __kthread_parkme+0x21e/0x260
[ 1236.609789]  kthread+0x3a6/0x490
[ 1236.609800]  ? __pfx_worker_thread+0x10/0x10
[ 1236.609809]  ? __pfx_kthread+0x10/0x10
[ 1236.609820]  ret_from_fork+0x55a/0xa20
[ 1236.609835]  ? __pfx_ret_from_fork+0x10/0x10
[ 1236.609850]  ? __pfx_kthread+0x10/0x10
[ 1236.609861]  ret_from_fork_asm+0x1a/0x30
[ 1236.609880]  </TASK>
[ 1236.609886]
[ 1236.661292] Allocated by task 5076:
[ 1236.662640]  kasan_save_track+0x3e/0x80
[ 1236.663842]  __kasan_kmalloc+0x72/0x90
[ 1236.664763]  __kmalloc_noprof+0x2b0/0x5d0
[ 1236.665356]  __ib_alloc_cq+0x284/0x1000
[ 1236.666573]  __ib_alloc_cq_any+0x23e/0x340
[ 1236.668654]  smbdirect_connection_create_qp+0x6f7/0x1070
[ 1236.669757]  smbdirect_accept_connect_request+0x500/0x1ca0
[ 1236.672625]  smbdirect_listen_rdma_event_handler+0x1655/0x1c50
[ 1236.673930]  cma_listen_handler+0x1bf/0x260
[ 1236.674923]  cma_cm_event_handler+0x128/0x380
[ 1236.676926]  cma_ib_req_handler+0x2d3d/0x4de0
[ 1236.678368]  cm_process_work+0xb0/0x530
[ 1236.680454]  cm_queue_work_unlock+0xb1/0x230
[ 1236.681673]  cm_work_handler+0x969f/0xdca0
[ 1236.682704]  process_scheduled_works+0xc22/0x1600
[ 1236.683447]  worker_thread+0x975/0xee0
[ 1236.685901]  kthread+0x3a6/0x490
[ 1236.688164]  ret_from_fork+0x55a/0xa20
[ 1236.689522]  ret_from_fork_asm+0x1a/0x30
[ 1236.690073]
[ 1236.690378] Freed by task 5137:
[ 1236.692242]  kasan_save_track+0x3e/0x80
[ 1236.694272]  kasan_save_free_info+0x40/0x50
[ 1236.695514]  __kasan_slab_free+0x3a/0x60
[ 1236.696773]  kfree+0x14e/0x4e0
[ 1236.697216]  ib_destroy_cq_user+0x18d/0x250
[ 1236.699817]  smbdirect_connection_destroy_qp+0xf2/0x280
[ 1236.702115]  smbdirect_socket_destroy_sync+0x1607/0x2720
[ 1236.704062]  smbdirect_socket_release+0x140/0x280
[ 1236.705286]  smb_direct_free_transport+0x3b/0x90
[ 1236.707241]  __ksmbd_conn_release_work+0x99/0xf0
[ 1236.709287]  process_scheduled_works+0xc22/0x1600
[ 1236.710763]  worker_thread+0x975/0xee0
[ 1236.711262]  kthread+0x3a6/0x490
[ 1236.711720]  ret_from_fork+0x55a/0xa20
[ 1236.712232]  ret_from_fork_asm+0x1a/0x30
[ 1236.712762]
[ 1236.712992] Last potentially related work creation:
[ 1236.715157]  kasan_save_stack+0x3e/0x60
[ 1236.716993]  kasan_record_aux_stack+0x99/0xb0
[ 1236.718864]  insert_work+0xb2/0x4a0
[ 1236.720916]  __queue_work+0xebb/0x1260
[ 1236.722397]  queue_work_on+0x23b/0x350
[ 1236.723809]  ib_cq_completion_workqueue+0xac/0x160
[ 1236.724895]  rxe_cq_post+0x433/0x7c0
[ 1236.726273]  rxe_receiver+0xa41/0xd0d0
[ 1236.727754]  do_work+0x272/0x860
[ 1236.728896]  process_scheduled_works+0xc22/0x1600
[ 1236.730026]  worker_thread+0x975/0xee0
[ 1236.731499]  kthread+0x3a6/0x490
[ 1236.732132]  ret_from_fork+0x55a/0xa20
[ 1236.733171]  ret_from_fork_asm+0x1a/0x30
[ 1236.734224]
[ 1236.734871] Second to last potentially related work creation:
[ 1236.736001]  kasan_save_stack+0x3e/0x60
[ 1236.737161]  kasan_record_aux_stack+0x99/0xb0
[ 1236.739074]  insert_work+0xb2/0x4a0
[ 1236.740414]  __queue_work+0xebb/0x1260
[ 1236.740932]  queue_work_on+0x23b/0x350
[ 1236.741849]  ib_cq_completion_workqueue+0xac/0x160
[ 1236.744099]  rxe_cq_post+0x433/0x7c0
[ 1236.745514]  rxe_receiver+0xa41/0xd0d0
[ 1236.746091]  do_work+0x272/0x860
[ 1236.747187]  process_scheduled_works+0xc22/0x1600
[ 1236.749060]  worker_thread+0x975/0xee0
[ 1236.750224]  kthread+0x3a6/0x490
[ 1236.751480]  ret_from_fork+0x55a/0xa20
[ 1236.751989]  ret_from_fork_asm+0x1a/0x30
[ 1236.752974]
[ 1236.753627] The buggy address belongs to the object at ffff888111865800
[ 1236.753627]  which belongs to the cache kmalloc-1k of size 1024
[ 1236.757729] The buggy address is located 0 bytes inside of
[ 1236.757729]  freed 1024-byte region [ffff888111865800, ffff888111865c00)
[ 1236.760816]
[ 1236.761373] The buggy address belongs to the physical page:
[ 1236.762599] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x111860
[ 1236.764306] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 1236.765281] flags: 0x100000000000040(head|node=0|zone=2)
[ 1236.765979] page_type: f5(slab)
[ 1236.766410] raw: 0100000000000040 ffff8881000430c0 ffffea0004a7e210 ffffea0004586210
[ 1236.770418] raw: 0000000000000000 00000000000a000a 00000000f5000000 0000000000000000
[ 1236.775899] head: 0100000000000040 ffff8881000430c0 ffffea0004a7e210 ffffea0004586210
[ 1236.782823] head: 0000000000000000 00000000000a000a 00000000f5000000 0000000000000000
[ 1236.786239] head: 0100000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
[ 1236.790658] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
[ 1236.794132] page dumped because: kasan: bad access detected
[ 1236.798301]
[ 1236.799640] Memory state around the buggy address:
[ 1236.802028]  ffff888111865700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 1236.806254]  ffff888111865780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 1236.809036] >ffff888111865800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1236.813968]                    ^
[ 1236.816416]  ffff888111865880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1236.819454]  ffff888111865900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 1236.823143] ==================================================================
[ 1236.830365] Disabling lock debugging due to kernel taint
[ 1236.831136] BUG: unable to handle page fault for address: ffffc90006dc8080
[ 1236.838157] #PF: supervisor read access in kernel mode
[ 1236.843686] #PF: error_code(0x0000) - not-present page
[ 1236.849393] PGD 100000067 P4D 100000067 PUD 100366067 PMD 12913e067 PTE 0
[ 1236.854156] Oops: Oops: 0000 [#1] SMP KASAN NOPTI
[ 1236.857893] CPU: 4 UID: 0 PID: 82 Comm: kworker/4:1H Tainted: G    B               7.2.0-rc3-next-20260717-virtme #110 PREEMPT(lazy)
[ 1236.860893] ksmbd: smb_direct: smbdirect_connection_recv_io_refill() failed -ECONNRESET
[ 1236.864209] Tainted: [B]=BAD_PAGE
[ 1236.864220] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014
[ 1236.864233] Workqueue: ib-comp-wq ib_cq_poll_work
[ 1236.878314] RIP: 0010:rxe_req_notify_cq+0x13a/0x350
[ 1236.881683] Code: 20 87 fd 4c 89 fe 48 ba 00 00 00 00 00 fc ff df 4c 8b 3e 49 83 ef 80 4c 89 f8 48 c1 e8 03 0f b6 04 10 84 c0 0f 85 9b 01 00 00 <45> 8b 2f 41 80 3c 16 00 74 18 49 89 f6 48 89 f7 e8 71 20 87 fd 4c
[ 1236.886819] ksmbd: smb_direct: smbdirect_connection_recv_io_refill() failed -ECONNRESET
[ 1236.890671] RSP: 0018:ffff88810222f920 EFLAGS: 00010046
[ 1236.890705] RAX: 0000000000000000 RBX: ffff88810222f920 RCX: ffffffff84c92863
[ 1236.901613] RDX: dffffc0000000000 RSI: ffff888120456d48 RDI: ffff888120456d48
[ 1236.903979] RBP: ffff88810222fa20 R08: 0000000000000003 R09: 0000000000000004
[ 1236.908958] R10: dffffc0000000000 R11: ffffed1020445f10 R12: ffff888120456d40
[ 1236.914473] R13: dffffc0000000000 R14: 1ffff1102408ada9 R15: ffffc90006dc8080
[ 1236.918946] FS:  0000000000000000(0000) GS:ffff88842600d000(0000) knlGS:0000000000000000
[ 1236.921600] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1236.925779] CR2: ffffc90006dc8080 CR3: 000000012b35f003 CR4: 0000000000f72ef0
[ 1236.926809] ksmbd: smb_direct: smbdirect_connection_recv_io_refill() failed -ECONNRESET
[ 1236.928302] PKRU: 55555554
[ 1236.928328] Call Trace:
[ 1236.928338]  <TASK>
[ 1236.928352]  ? ib_cq_poll_work+0xd0/0x1a0
[ 1236.928374]  ? __pfx_rxe_req_notify_cq+0x10/0x10
[ 1236.941601]  ? ib_cq_poll_work+0xd0/0x1a0
[ 1236.943306]  ib_cq_poll_work+0xfe/0x1a0
[ 1236.943961]  ? process_scheduled_works+0x954/0x1600
[ 1236.947036]  process_scheduled_works+0xc22/0x1600
[ 1236.951626]  ? __pfx_process_scheduled_works+0x10/0x10
[ 1236.954316]  ? __pfx_assign_work+0x10/0x10
[ 1236.958110]  ? lock_is_held_type+0x7b/0x110
[ 1236.960042]  worker_thread+0x975/0xee0
[ 1236.962668]  ? __pfx_do_raw_spin_lock+0x10/0x10
[ 1236.965334]  ? __kthread_parkme+0x21e/0x260
[ 1236.966058]  kthread+0x3a6/0x490
[ 1236.968115]  ? __pfx_worker_thread+0x10/0x10
[ 1236.971020]  ? __pfx_kthread+0x10/0x10
[ 1236.974488]  ret_from_fork+0x55a/0xa20
[ 1236.977419]  ? __pfx_ret_from_fork+0x10/0x10
[ 1236.979846]  ? __pfx_kthread+0x10/0x10
[ 1236.981238]  ret_from_fork_asm+0x1a/0x30
[ 1236.984086]  </TASK>
[ 1236.986181] Modules linked in:
[ 1236.989048] CR2: ffffc90006dc8080
[ 1236.990412] ---[ end trace 0000000000000000 ]---
[ 1236.994119] RIP: 0010:rxe_req_notify_cq+0x13a/0x350
[ 1236.998482] Code: 20 87 fd 4c 89 fe 48 ba 00 00 00 00 00 fc ff df 4c 8b 3e 49 83 ef 80 4c 89 f8 48 c1 e8 03 0f b6 04 10 84 c0 0f 85 9b 01 00 00 <45> 8b 2f 41 80 3c 16 00 74 18 49 89 f6 48 89 f7 e8 71 20 87 fd 4c
[ 1237.006635] RSP: 0018:ffff88810222f920 EFLAGS: 00010046
[ 1237.008513] RAX: 0000000000000000 RBX: ffff88810222f920 RCX: ffffffff84c92863
[ 1237.014100] RDX: dffffc0000000000 RSI: ffff888120456d48 RDI: ffff888120456d48
[ 1237.021058] RBP: ffff88810222fa20 R08: 0000000000000003 R09: 0000000000000004
[ 1237.024939] R10: dffffc0000000000 R11: ffffed1020445f10 R12: ffff888120456d40
[ 1237.030203] R13: dffffc0000000000 R14: 1ffff1102408ada9 R15: ffffc90006dc8080
[ 1237.034299] FS:  0000000000000000(0000) GS:ffff88842600d000(0000) knlGS:0000000000000000
[ 1237.037311] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1237.042838] CR2: ffffc90006dc8080 CR3: 000000012b35f003 CR4: 0000000000f72ef0

Found with ksmbdzzer [2], a KSMBD fuzzer that drives libFuzzer with a
kcov-dataflow [1] coverage vector: it folds each instrumented
comparison/argument's runtime operand value together with its PC (the
default arm mixes them as pc⊕val) so that a new operand value at a known
site counts as new coverage.

[1] https://lwn.net/Articles/1077606/
[2] https://github.com/yskzalloc/kcov-dataflow

The Linux kernel CVE team has assigned CVE-2026-90173 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 7.1 with commit 6073eb3e31756d569c4853fb22724525739d0e0c and fixed in 7.2.6 with commit 8a953b1a47fffb71e70767bc1e914401e3c2f27f
	Issue introduced in 7.1 with commit 6073eb3e31756d569c4853fb22724525739d0e0c and fixed in 7.3-rc1 with commit fe2c0cacbcff9d56c03b296f68f22151c4223b04

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-90173
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/smb/smbdirect/connection.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/8a953b1a47fffb71e70767bc1e914401e3c2f27f
	https://git.kernel.org/stable/c/fe2c0cacbcff9d56c03b296f68f22151c4223b04