CVE-2026-90173

In the Linux kernel, the following vulnerability has been resolved:

smb: smbdirect: free completion queues with ibfreecq()

smbdirectconnectiondestroy_qp() creates the send and receive completion

queues with iballoccqany(), which for IBPOLL_WORKQUEUE arms an

internal completion handler that runs ibcqpoll_work() on a workqueue.

Tearing those CQs down with ibdestroycq() frees them without first

cancelling that poll work.

If the provider posts a completion late -- for example Soft-RoCE (rxe)

posting an RNR error from rxereceiver() after rdmadestroy_qp() -- the

handler re-queues ibcqpoll_work() on the already-freed CQ, and a

follow-on access faults in rxereqnotify_cq().

Use ibfreecq(), which cancelworksync()es the poll work before freeing

the CQ, so no completion handler can run against a freed queue.

[ 1236.599526] ==================================================================

[ 1236.602142] BUG: KASAN: slab-use-after-free in ibcqpoll_work+0xd0/0x1a0

[ 1236.605524] Read of size 8 at addr ffff888111865800 by task kworker/4:1H/82

[ 1236.609017]

[ 1236.609270] CPU: 4 UID: 0 PID: 82 Comm: kworker/4:1H Not tainted 7.2.0-rc3-next-20260717-virtme #110 PREEMPT(lazy)

[ 1236.609287] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014

[ 1236.609498] Workqueue: ib-comp-wq ibcqpoll_work

[ 1236.609525] Call Trace:

[ 1236.609536]  <TASK>

[ 1236.609545]  _dumpstack+0x21/0x60

[ 1236.609562]  dumpstacklvl+0xc2/0x100

[ 1236.609573]  printaddressdescription+0x77/0x200

[ 1236.609587]  ? ibcqpoll_work+0xd0/0x1a0

[ 1236.609597]  print_report+0x58/0x70

[ 1236.609607]  kasan_report+0x117/0x150

[ 1236.609623]  ? ibcqpoll_work+0xd0/0x1a0

[ 1236.609636]  ? processscheduledworks+0x954/0x1600

[ 1236.609650]  ibcqpoll_work+0xd0/0x1a0

[ 1236.609662]  ? processscheduledworks+0x954/0x1600

[ 1236.609674]  processscheduledworks+0xc22/0x1600

[ 1236.609698]  ? _pfxprocessscheduledworks+0x10/0x10

[ 1236.609713]  ? _pfxassign_work+0x10/0x10

[ 1236.609726]  ? lockisheld_type+0x7b/0x110

[ 1236.609741]  worker_thread+0x975/0xee0

[ 1236.609757]  ? _pfxdorawspin_lock+0x10/0x10

[ 1236.609775]  ? _kthreadparkme+0x21e/0x260

[ 1236.609789]  kthread+0x3a6/0x490

[ 1236.609800]  ? _pfxworker_thread+0x10/0x10

[ 1236.609809]  ? _pfxkthread+0x10/0x10

[ 1236.609820]  retfromfork+0x55a/0xa20

[ 1236.609835]  ? _pfxretfromfork+0x10/0x10

[ 1236.609850]  ? _pfxkthread+0x10/0x10

[ 1236.609861]  retfromfork_asm+0x1a/0x30

[ 1236.609880]  </TASK>

[ 1236.609886]

[ 1236.661292] Allocated by task 5076:

[ 1236.662640]  kasansavetrack+0x3e/0x80

[ 1236.663842]  _kasankmalloc+0x72/0x90

[ 1236.664763]  _kmallocnoprof+0x2b0/0x5d0

[ 1236.665356]  _iballoc_cq+0x284/0x1000

[ 1236.666573]  _iballoccqany+0x23e/0x340

[ 1236.668654]  smbdirectconnectioncreate_qp+0x6f7/0x1070

[ 1236.669757]  smbdirectacceptconnect_request+0x500/0x1ca0

[ 1236.672625]  smbdirectlistenrdmaeventhandler+0x1655/0x1c50

[ 1236.673930]  cmalistenhandler+0x1bf/0x260

[ 1236.674923]  cmacmevent_handler+0x128/0x380

[ 1236.676926]  cmaibreq_handler+0x2d3d/0x4de0

[ 1236.678368]  cmprocesswork+0xb0/0x530

[ 1236.680454]  cmqueuework_unlock+0xb1/0x230

[ 1236.681673]  cmworkhandler+0x969f/0xdca0

[ 1236.682704]  processscheduledworks+0xc22/0x1600

[ 1236.683447]  worker_thread+0x975/0xee0

[ 1236.685901]  kthread+0x3a6/0x490

[ 1236.688164]  retfromfork+0x55a/0xa20

[ 1236.689522]  retfromfork_asm+0x1a/0x30

[ 1236.690073]

[ 1236.690378] Freed by task 5137:

[ 1236.692242]  kasansavetrack+0x3e/0x80

[ 1236.694272]  kasansavefree_info+0x40/0x50

[ 1236.695514]  _kasanslab_free+0x3a/0x60

[ 1236.696773]  kfree+0x14e/0x4e0

[ 1236.697216]  ibdestroycq_user+0x18d/0x250

[ 1236.699817]  smbdirectconnectiondestroy_qp+0xf2/0x280

[ 1236.702115]  smbdirectsocketdestroy_sync+0x1607/0x2720

[ 1236.704062]  smbdirectsocketrelease+0x140/0x280

[ 1236.705286]  smbdirectfree_transpor

---truncated---