Memory leak in Linux kernel - CVE-2026-90107
Published: September 19, 2026
Vulnerability identifier: #VU151378
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-90107
CWE-ID: CWE-401
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause a denial of service.
The vulnerability exists due to a memory leak in smc_llc_flow_stop() when a late duplicate CONFIRM_LINK or ADD_LINK_CONT message arrives before the flow completes. A remote attacker can send a duplicate message during this window to cause a denial of service.
Affected software
Linux kernel
How to mitigate CVE-2026-90107
Install security update from vendor's repository.
External References
- https://git.kernel.org/stable/c/032aec7d03c9102616b98fea74f8f7145e7f867c
- https://git.kernel.org/stable/c/0879ea157acc1ac6752f6fcb755d1f91a2359238
- https://git.kernel.org/stable/c/11bc373ee6630709f0c2da2e7860c23d503c9e9d
- https://git.kernel.org/stable/c/5ee0ceddc7785c6dcf4a8107fef01f0414a354f4
- https://git.kernel.org/stable/c/5ff429dd6725fa6c1e17a4ed0be8ab675f67a98b
- https://git.kernel.org/stable/c/8e3deb150a5237b672c4579e69a6deb02027dbed
- https://git.kernel.org/stable/c/957dba2b8b5aebfe09caa6a6b22b958079082eab
- https://git.kernel.org/stable/c/f03aa5d36ae3c4068a1c3885146be99aa7fd9307