{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  net/smc: free pending qentry in smc_llc_flow_stop() before memset  smc_llc_flow_stop() resets a flow struct with a blind memset:  \tspin_lock_bh(\u0026lgr-\u003ellc_flow_lock); \tmemset(flow, 0, sizeof(*flow)); \tflow-\u003etype = SMC_LLC_FLOW_NONE; \tspin_unlock_bh(\u0026lgr-\u003ellc_flow_lock);  If flow-\u003eqentry is non-NULL at this point the pointer is overwritten without the allocation being freed, leaking one kmalloc object.  A late-arriving duplicate CONFIRM_LINK or ADD_LINK_CONT message can set flow-\u003eqentry after the legitimate message has been consumed by the waiter via smc_llc_flow_qentry_clr() (which NULLs the pointer but leaves flow-\u003etype non-zero) but before the flow completes and smc_llc_flow_stop() runs.  In that window the duplicate is stashed into flow-\u003eqentry, and then lost when smc_llc_flow_stop() zeros the struct.  Call smc_llc_flow_qentry_del() inside the lock before the memset. smc_llc_flow_qentry_del() already checks flow-\u003eqentry before freeing, so the normal case where no entry is pending is a no-op.",
  "id": "DEBIAN-CVE-2026-90107",
  "modified": "2026-09-18T04:47:24.448847186Z",
  "published": "2026-09-17T17:17:02.570Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-90107"
    }
  ],
  "upstream": [
    "CVE-2026-90107"
  ]
}