CVE-2026-80979

Status: UPDATED  |  Advisory ID: CVE-2026-80979

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

net/smc: unregister the connection before draining the rx tasklet

smc_conn_free() calls smc_ism_unset_conn() only while the link group is

still on its device list, and never sets conn->killed.

smc_lgr_terminate_sched() unlinks the group immediately and defers killing

its connections to a work item, so a connection freed in that window keeps

its smcd->conn[] slot with both gates in smcd_handle_irq() open, and the

device can re-arm the receive tasklet after tasklet_kill() has returned. On

the DMB-nocopy path the ghost send buffer is freed right after that drain,

so the re-armed tasklet dereferences it.

Unregister unconditionally and drain before the detach at both teardown

sites, mirroring rmb_desc, which smc_buf_unuse() releases after the drain.

Clear conn->sndbuf_desc before freeing it as well, so a reader that samples

the pointer cannot get one that is already freed. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References