SB20260919110 - Memory leak in Linux kernel smc
Published: September 19, 2026
Security Bulletin ID
SB20260919110
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Partial DoS
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Memory leak (CVE-ID: CVE-2026-90107)
CWE-ID: CWE-401 - Missing release of memory after effective lifetime
CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a memory leak in smc_llc_flow_stop() when a late duplicate CONFIRM_LINK or ADD_LINK_CONT message arrives before the flow completes. A remote attacker can send a duplicate message during this window to cause a denial of service.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/032aec7d03c9102616b98fea74f8f7145e7f867c
- https://git.kernel.org/stable/c/0879ea157acc1ac6752f6fcb755d1f91a2359238
- https://git.kernel.org/stable/c/11bc373ee6630709f0c2da2e7860c23d503c9e9d
- https://git.kernel.org/stable/c/5ee0ceddc7785c6dcf4a8107fef01f0414a354f4
- https://git.kernel.org/stable/c/5ff429dd6725fa6c1e17a4ed0be8ab675f67a98b
- https://git.kernel.org/stable/c/8e3deb150a5237b672c4579e69a6deb02027dbed
- https://git.kernel.org/stable/c/957dba2b8b5aebfe09caa6a6b22b958079082eab
- https://git.kernel.org/stable/c/f03aa5d36ae3c4068a1c3885146be99aa7fd9307