{"id":"AZL-102797","summary":"CVE-2026-90107 affecting package kernel 6.6.150.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: free pending qentry in smc_llc_flow_stop() before memset\n\nsmc_llc_flow_stop() resets a flow struct with a blind memset:\n\n\tspin_lock_bh(&lgr-\u003ellc_flow_lock);\n\tmemset(flow, 0, sizeof(*flow));\n\tflow-\u003etype = SMC_LLC_FLOW_NONE;\n\tspin_unlock_bh(&lgr-\u003ellc_flow_lock);\n\nIf flow-\u003eqentry is non-NULL at this point the pointer is overwritten without the\nallocation being freed, leaking one kmalloc object.\n\nA late-arriving duplicate CONFIRM_LINK or ADD_LINK_CONT message can set\nflow-\u003eqentry after the legitimate message has been consumed by the waiter via\nsmc_llc_flow_qentry_clr() (which NULLs the pointer but leaves flow-\u003etype\nnon-zero) but before the flow completes and smc_llc_flow_stop() runs.  In that\nwindow the duplicate is stashed into flow-\u003eqentry, and then lost when\nsmc_llc_flow_stop() zeros the struct.\n\nCall smc_llc_flow_qentry_del() inside the lock before the memset.\nsmc_llc_flow_qentry_del() already checks flow-\u003eqentry before freeing, so the\nnormal case where no entry is pending is a no-op.","modified":"2026-09-19T05:33:49Z","published":"2026-09-17T17:17:02Z","upstream":["CVE-2026-90107"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90107"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.150.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-102797.json"}}],"schema_version":"1.9.0"}