CVE-2026-64541

Status: UPDATED  |  Advisory ID: CVE-2026-64541

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket

smc_cdc_rx_handler() looks up the connection by token under the link

group's conns_lock, drops the lock, and then dereferences conn and the

smc_sock derived from it, ending in sock_hold(&smc->sk) inside

smc_cdc_msg_recv(). No reference is held across the lock release.

The only reference pinning the socket while the connection is

discoverable in the link group is taken in smc_lgr_register_conn()

(sock_hold) and dropped in __smc_lgr_unregister_conn() (sock_put), both

under conns_lock. Once the handler drops conns_lock, a concurrent

close() -> smc_release() -> smc_conn_free() -> smc_lgr_unregister_conn()

can drop that reference and free the smc_sock, so the handler's later

sock_hold() runs on freed memory:

WARNING: lib/refcount.c:25 at refcount_warn_saturate

Workqueue: rxe_wq do_work

refcount_warn_saturate (lib/refcount.c:25)

smc_cdc_msg_recv (net/smc/smc_cdc.c:430)

smc_cdc_rx_handler (net/smc/smc_cdc.c:502)

smc_wr_rx_tasklet_fn (net/smc/smc_wr.c:445)

tasklet_action_common (kernel/softirq.c:938)

handle_softirqs (kernel/softirq.c:622)

Kernel panic - not syncing: panic_on_warn set

Only SMC-R is affected. The SMC-D receive tasklet is stopped by

tasklet_kill(&conn->rx_tsklet) in smc_conn_free() before the connection

is unregistered, so it cannot run concurrently with the free.

Take the socket reference while still holding conns_lock, so the

registration reference can no longer be the last one, and drop it once

the handler is done. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References