In the Linux kernel, the following vulnerability has been resolved:
smb: client: let smbd_destroy() call disable_work_sync(&info->post_send_credits_work)
In smbd_destroy() we may destroy the memory so we better wait until post_send_credits_work is no longer pending and will never be started again.
I actually just hit the case using rxe:
WARNING: CPU: 0 PID: 138 at drivers/infiniband/sw/rxe/rxe_verbs.c:1032 rxe_post_recv+0x1ee/0x480 [rdma_rxe] ... [ 5305.686979] [ T138] smbd_post_recv+0x445/0xc10 [cifs] [ 5305.687135] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5305.687149] [ T138] ? __kasan_check_write+0x14/0x30 [ 5305.687185] [ T138] ? __pfx_smbd_post_recv+0x10/0x10 [cifs] [ 5305.687329] [ T138] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 5305.687356] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5305.687368] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5305.687378] [ T138] ? _raw_spin_unlock_irqrestore+0x11/0x60 [ 5305.687389] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5305.687399] [ T138] ? get_receive_buffer+0x168/0x210 [cifs] [ 5305.687555] [ T138] smbd_post_send_credits+0x382/0x4b0 [cifs] [ 5305.687701] [ T138] ? __pfx_smbd_post_send_credits+0x10/0x10 [cifs] [ 5305.687855] [ T138] ? __pfx___schedule+0x10/0x10 [ 5305.687865] [ T138] ? __pfx__raw_spin_lock_irq+0x10/0x10 [ 5305.687875] [ T138] ? queue_delayed_work_on+0x8e/0xa0 [ 5305.687889] [ T138] process_one_work+0x629/0xf80 [ 5305.687908] [ T138] ? srso_alias_return_thunk+0x5/0xfbef5 [ 5305.687917] [ T138] ? __kasan_check_write+0x14/0x30 [ 5305.687933] [ T138] worker_thread+0x87f/0x1570 ...
It means rxe_post_recv was called after rdma_destroy_qp(). This happened because put_receive_buffer() was triggered by ib_drain_qp() and called: queue_work(info->workqueue, &info->post_send_credits_work);
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Oracle_linux | — | Upgrade kernel-uek | Nov 11, 2025 | Oct 4, 2025 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Oct 4, 2025 |
| Ubuntu | — | Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-lowlatencyUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-6.8.0-1049-nvidia-lowlatencyUpgrade linux-image-generic-lpaeUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-6.8.0-1050-awsUpgrade linux-image-6.8.0-1052-gcp-64kUpgrade linux-image-oracle-64kUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-gkeUpgrade linux-image-fips-6.8Upgrade linux-image-gcp-fips-6.8Upgrade linux-image-ibm-6.8Upgrade linux-image-azure-fips-6.8Upgrade linux-image-realtimeUpgrade linux-image-aws-64kUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-gkeopUpgrade linux-image-generic-6.8Upgrade linux-image-gcpUpgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-1047-oracleUpgrade linux-image-6.8.0-1052-azure-fipsUpgrade linux-image-aws-64k-6.8Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-1050-aws-fipsUpgrade linux-image-aws-fips-6.8Upgrade linux-image-gcp-6.8Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-6.8.0-1052-gcpUpgrade linux-image-raspi-realtimeUpgrade linux-image-virtualUpgrade linux-image-6.8.1-1045-realtimeUpgrade linux-image-intel-iot-realtimeUpgrade linux-image-gkeop-6.8Upgrade linux-image-gcp-fipsUpgrade linux-image-generic-64k-6.8Upgrade linux-image-azureUpgrade linux-image-raspiUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-awsUpgrade linux-image-6.8.0-106-lowlatencyUpgrade linux-image-6.8.0-106-genericUpgrade linux-image-6.8.0-1052-gcp-fipsUpgrade linux-image-6.8.0-1050-aws-64kUpgrade linux-image-6.8.0-1049-nvidiaUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-oracle-6.8Upgrade linux-image-6.8.0-1049-nvidia-lowlatency-64kUpgrade linux-image-oem-22.04cUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-nvidiaUpgrade linux-image-6.8.0-106-lowlatency-64kUpgrade linux-image-realtime-6.8.1Upgrade linux-image-aws-lts-24.04Upgrade linux-image-gcp-lts-24.04Upgrade linux-image-virtual-6.8Upgrade linux-image-gke-64k-6.8Upgrade linux-image-gke-64kUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-aws-6.8Upgrade linux-image-generic-64kUpgrade linux-image-oem-22.04Upgrade linux-image-6.8.0-1047-oracle-64kUpgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-aws-fipsUpgrade linux-image-6.8.0-1029-xilinxUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-xilinx-6.8Upgrade linux-image-lowlatency-6.8Upgrade linux-image-fipsUpgrade linux-image-raspi-6.8Upgrade linux-image-oem-22.04dUpgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-azure-fipsUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-nvidia-6.8Upgrade linux-image-6.8.0-2040-raspi-realtimeUpgrade linux-image-gcp-64kUpgrade linux-image-lowlatency-64kUpgrade linux-image-gke-6.8Upgrade linux-image-6.8.0-1035-gkeopUpgrade linux-image-azure-6.8Upgrade linux-image-generic-hwe-22.04Upgrade linux-image-oem-22.04aUpgrade linux-image-oracleUpgrade linux-image-oem-22.04bUpgrade linux-image-ibm-classicUpgrade linux-image-intel-iotgUpgrade linux-image-6.8.0-1048-gkeUpgrade linux-image-6.8.0-1048-gke-64kUpgrade linux-image-ibmUpgrade linux-image-xilinxUpgrade linux-image-6.8.0-1049-ibmUpgrade linux-image-genericUpgrade linux-image-kvmUpgrade linux-image-azure-lts-24.04Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-6.8.0-1050-raspiUpgrade linux-image-6.8.0-106-generic-64kUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-6.8.0-1051-azureUpgrade linux-image-6.8.0-106-fipsUpgrade linux-image-6.8.0-1049-nvidia-64k | Mar 17, 2026 | Oct 4, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub