CVE-2026-64541

In the Linux kernel, the following vulnerability has been resolved:

net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket

smc_cdc_rx_handler() looks up the connection by token under the link groups conns_lock, drops the lock, and then dereferences conn and the smc_sock derived from it, ending in sock_hold(&smc->sk) inside smc_cdc_msg_recv(). No reference is held across the lock release.

The only reference pinning the socket while the connection is discoverable in the link group is taken in smc_lgr_register_conn() (sock_hold) and dropped in __smc_lgr_unregister_conn() (sock_put), both under conns_lock. Once the handler drops conns_lock, a concurrent close() -> smc_release() -> smc_conn_free() -> smc_lgr_unregister_conn() can drop that reference and free the smc_sock, so the handlers later sock_hold() runs on freed memory:

WARNING: lib/refcount.c:25 at refcount_warn_saturate Workqueue: rxe_wq do_work refcount_warn_saturate (lib/refcount.c:25) smc_cdc_msg_recv (net/smc/smc_cdc.c:430) smc_cdc_rx_handler (net/smc/smc_cdc.c:502) smc_wr_rx_tasklet_fn (net/smc/smc_wr.c:445) tasklet_action_common (kernel/softirq.c:938) handle_softirqs (kernel/softirq.c:622) Kernel panic - not syncing: panic_on_warn set

Only SMC-R is affected. The SMC-D receive tasklet is stopped by tasklet_kill(&conn->rx_tsklet) in smc_conn_free() before the connection is unregistered, so it cannot run concurrently with the free.

Take the socket reference while still holding conns_lock, so the registration reference can no longer be the last one, and drop it once the handler is done.

Weakness

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory “belongs” to the code that operates on the new pointer.

Affected Software

Potential Mitigations

References

• https://git.kernel.org/stable/c/1951bffbc6493ec34cff3956b29d4bc6606904a6
• https://git.kernel.org/stable/c/3bfb96d9bc6a7ed0b99c7db329cc2e22a28d84bb
• https://git.kernel.org/stable/c/472e9d7c0d5b03be3ff91ff941f57da822b031bc
• https://git.kernel.org/stable/c/647b19e5cc145a2f1f685ae8ff3805a17356888c
• https://git.kernel.org/stable/c/8145b432136285e01091815b48ceb2dae261f262
• https://git.kernel.org/stable/c/8de4f665d0febfb92803dece377791a563fc7041
• https://git.kernel.org/stable/c/9d160b35cc34a2ba8229d07651468a7848325135
• https://git.kernel.org/stable/c/ce5aa8084329351086894aa34d77e40301d5bd3d