CVE-2026-23450 (GCVE-0-2026-23450)

Vulnerability from cvelistv5 – Published: 2026-04-03 15:15 – Updated: 2026-07-14 12:47
VLAI
Title
net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
Summary
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() Syzkaller reported a panic in smc_tcp_syn_recv_sock() [1]. smc_tcp_syn_recv_sock() is called in the TCP receive path (softirq) via icsk_af_ops->syn_recv_sock on the clcsock (TCP listening socket). It reads sk_user_data to get the smc_sock pointer. However, when the SMC listen socket is being closed concurrently, smc_close_active() sets clcsock->sk_user_data to NULL under sk_callback_lock, and then the smc_sock itself can be freed via sock_put() in smc_release(). This leads to two issues: 1) NULL pointer dereference: sk_user_data is NULL when accessed. 2) Use-after-free: sk_user_data is read as non-NULL, but the smc_sock is freed before its fields (e.g., queued_smc_hs, ori_af_ops) are accessed. The race window looks like this (the syzkaller crash [1] triggers via the SYN cookie path: tcp_get_cookie_sock() -> smc_tcp_syn_recv_sock(), but the normal tcp_check_req() path has the same race): CPU A (softirq) CPU B (process ctx) tcp_v4_rcv() TCP_NEW_SYN_RECV: sk = req->rsk_listener sock_hold(sk) /* No lock on listener */ smc_close_active(): write_lock_bh(cb_lock) sk_user_data = NULL write_unlock_bh(cb_lock) ... smc_clcsock_release() sock_put(smc->sk) x2 -> smc_sock freed! tcp_check_req() smc_tcp_syn_recv_sock(): smc = user_data(sk) -> NULL or dangling smc->queued_smc_hs -> crash! Note that the clcsock and smc_sock are two independent objects with separate refcounts. TCP stack holds a reference on the clcsock, which keeps it alive, but this does NOT prevent the smc_sock from being freed. Fix this by using RCU and refcount_inc_not_zero() to safely access smc_sock. Since smc_tcp_syn_recv_sock() is called in the TCP three-way handshake path, taking read_lock_bh on sk_callback_lock is too heavy and would not survive a SYN flood attack. Using rcu_read_lock() is much more lightweight. - Set SOCK_RCU_FREE on the SMC listen socket so that smc_sock freeing is deferred until after the RCU grace period. This guarantees the memory is still valid when accessed inside rcu_read_lock(). - Use rcu_read_lock() to protect reading sk_user_data. - Use refcount_inc_not_zero(&smc->sk.sk_refcnt) to pin the smc_sock. If the refcount has already reached zero (close path completed), it returns false and we bail out safely. Note: smc_hs_congested() has a similar lockless read of sk_user_data without rcu_read_lock(), but it only checks for NULL and accesses the global smc_hs_wq, never dereferencing any smc_sock field, so it is not affected. Reproducer was verified with mdelay injection and smc_run, the issue no longer occurs with this patch applied. [1] https://syzkaller.appspot.com/bug?extid=827ae2bfb3a3529333e9
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: ebfee3e153f67c8b38eb94a7062ee94aa6f92708 , < f315277856caeafcd996c2611afc085ca2d53275 (git)
Affected: 8270d9c21041470f58348248b9d9dcf3bf79592e , < 1e4f873879e075bbd4eb1c644d6933303ac5eba4 (git)
Affected: 8270d9c21041470f58348248b9d9dcf3bf79592e , < f00fc26c8a06442b225a350fe000c0a11483e6a3 (git)
Affected: 8270d9c21041470f58348248b9d9dcf3bf79592e , < cadf3da46c15523fba90d80c9955f536ee3b4023 (git)
Affected: 8270d9c21041470f58348248b9d9dcf3bf79592e , < fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2 (git)
Affected: 8270d9c21041470f58348248b9d9dcf3bf79592e , < 1fab5ece76fb42a761178dcd0ebcbf578377b0dd (git)
Affected: 8270d9c21041470f58348248b9d9dcf3bf79592e , < 6d5e4538364b9ceb1ac2941a4deb86650afb3538 (git)
Affected: 5.15.174 , < 5.15.203 (semver)
Create a notification for this product.
Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 5.15.203 , ≤ 5.15.* (semver)
Unaffected: 6.1.167 , ≤ 6.1.* (semver)
Unaffected: 6.6.130 , ≤ 6.6.* (semver)
Unaffected: 6.12.78 , ≤ 6.12.* (semver)
Unaffected: 6.18.20 , ≤ 6.18.* (semver)
Unaffected: 6.19.10 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.5 , < * (custom)
Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
Create a notification for this product.
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP Affected: V3.1.5 , < * (custom)
Create a notification for this product.
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.6 , < * (custom)
Create a notification for this product.
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP Affected: V3.1.5 , < * (custom)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.6",
                "versionType": "custom"
              }
            ]
          },
          {
            "defaultStatus": "unknown",
            "product": "SIPLUS S7-1500 CPU 1518-4 PN/DP MFP",
            "vendor": "Siemens",
            "versions": [
              {
                "lessThan": "*",
                "status": "affected",
                "version": "V3.1.5",
                "versionType": "custom"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-14T12:47:07.544Z",
          "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e",
          "shortName": "siemens-SADP"
        },
        "references": [
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-082556.html"
          },
          {
            "url": "https://cert-portal.siemens.com/productcert/html/ssa-019113.html"
          }
        ],
        "x_adpType": "supplier"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/smc/af_smc.c",
            "net/smc/smc.h",
            "net/smc/smc_close.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f315277856caeafcd996c2611afc085ca2d53275",
              "status": "affected",
              "version": "ebfee3e153f67c8b38eb94a7062ee94aa6f92708",
              "versionType": "git"
            },
            {
              "lessThan": "1e4f873879e075bbd4eb1c644d6933303ac5eba4",
              "status": "affected",
              "version": "8270d9c21041470f58348248b9d9dcf3bf79592e",
              "versionType": "git"
            },
            {
              "lessThan": "f00fc26c8a06442b225a350fe000c0a11483e6a3",
              "status": "affected",
              "version": "8270d9c21041470f58348248b9d9dcf3bf79592e",
              "versionType": "git"
            },
            {
              "lessThan": "cadf3da46c15523fba90d80c9955f536ee3b4023",
              "status": "affected",
              "version": "8270d9c21041470f58348248b9d9dcf3bf79592e",
              "versionType": "git"
            },
            {
              "lessThan": "fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2",
              "status": "affected",
              "version": "8270d9c21041470f58348248b9d9dcf3bf79592e",
              "versionType": "git"
            },
            {
              "lessThan": "1fab5ece76fb42a761178dcd0ebcbf578377b0dd",
              "status": "affected",
              "version": "8270d9c21041470f58348248b9d9dcf3bf79592e",
              "versionType": "git"
            },
            {
              "lessThan": "6d5e4538364b9ceb1ac2941a4deb86650afb3538",
              "status": "affected",
              "version": "8270d9c21041470f58348248b9d9dcf3bf79592e",
              "versionType": "git"
            },
            {
              "lessThan": "5.15.203",
              "status": "affected",
              "version": "5.15.174",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/smc/af_smc.c",
            "net/smc/smc.h",
            "net/smc/smc_close.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.20",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "5.15.174",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.78",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.20",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.10",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()\n\nSyzkaller reported a panic in smc_tcp_syn_recv_sock() [1].\n\nsmc_tcp_syn_recv_sock() is called in the TCP receive path\n(softirq) via icsk_af_ops-\u003esyn_recv_sock on the clcsock (TCP\nlistening socket). It reads sk_user_data to get the smc_sock\npointer. However, when the SMC listen socket is being closed\nconcurrently, smc_close_active() sets clcsock-\u003esk_user_data\nto NULL under sk_callback_lock, and then the smc_sock itself\ncan be freed via sock_put() in smc_release().\n\nThis leads to two issues:\n\n1) NULL pointer dereference: sk_user_data is NULL when\n   accessed.\n2) Use-after-free: sk_user_data is read as non-NULL, but the\n   smc_sock is freed before its fields (e.g., queued_smc_hs,\n   ori_af_ops) are accessed.\n\nThe race window looks like this (the syzkaller crash [1]\ntriggers via the SYN cookie path: tcp_get_cookie_sock() -\u003e\nsmc_tcp_syn_recv_sock(), but the normal tcp_check_req() path\nhas the same race):\n\n  CPU A (softirq)              CPU B (process ctx)\n\n  tcp_v4_rcv()\n    TCP_NEW_SYN_RECV:\n    sk = req-\u003ersk_listener\n    sock_hold(sk)\n    /* No lock on listener */\n                               smc_close_active():\n                                 write_lock_bh(cb_lock)\n                                 sk_user_data = NULL\n                                 write_unlock_bh(cb_lock)\n                                 ...\n                                 smc_clcsock_release()\n                                 sock_put(smc-\u003esk) x2\n                                   -\u003e smc_sock freed!\n    tcp_check_req()\n      smc_tcp_syn_recv_sock():\n        smc = user_data(sk)\n          -\u003e NULL or dangling\n        smc-\u003equeued_smc_hs\n          -\u003e crash!\n\nNote that the clcsock and smc_sock are two independent objects\nwith separate refcounts. TCP stack holds a reference on the\nclcsock, which keeps it alive, but this does NOT prevent the\nsmc_sock from being freed.\n\nFix this by using RCU and refcount_inc_not_zero() to safely\naccess smc_sock. Since smc_tcp_syn_recv_sock() is called in\nthe TCP three-way handshake path, taking read_lock_bh on\nsk_callback_lock is too heavy and would not survive a SYN\nflood attack. Using rcu_read_lock() is much more lightweight.\n\n- Set SOCK_RCU_FREE on the SMC listen socket so that\n  smc_sock freeing is deferred until after the RCU grace\n  period. This guarantees the memory is still valid when\n  accessed inside rcu_read_lock().\n- Use rcu_read_lock() to protect reading sk_user_data.\n- Use refcount_inc_not_zero(\u0026smc-\u003esk.sk_refcnt) to pin the\n  smc_sock. If the refcount has already reached zero (close\n  path completed), it returns false and we bail out safely.\n\nNote: smc_hs_congested() has a similar lockless read of\nsk_user_data without rcu_read_lock(), but it only checks for\nNULL and accesses the global smc_hs_wq, never dereferencing\nany smc_sock field, so it is not affected.\n\nReproducer was verified with mdelay injection and smc_run,\nthe issue no longer occurs with this patch applied.\n\n[1] https://syzkaller.appspot.com/bug?extid=827ae2bfb3a3529333e9"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T16:04:52.050Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275"
        },
        {
          "url": "https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4"
        },
        {
          "url": "https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538"
        }
      ],
      "title": "net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23450",
    "datePublished": "2026-04-03T15:15:33.144Z",
    "dateReserved": "2026-01-13T15:37:46.020Z",
    "dateUpdated": "2026-07-14T12:47:07.544Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23450",
      "date": "2026-07-24",
      "epss": "0.0056",
      "percentile": "0.43168"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23450\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-04-03T16:16:31.243\",\"lastModified\":\"2026-07-24T21:10:00.143\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()\\n\\nSyzkaller reported a panic in smc_tcp_syn_recv_sock() [1].\\n\\nsmc_tcp_syn_recv_sock() is called in the TCP receive path\\n(softirq) via icsk_af_ops-\u003esyn_recv_sock on the clcsock (TCP\\nlistening socket). It reads sk_user_data to get the smc_sock\\npointer. However, when the SMC listen socket is being closed\\nconcurrently, smc_close_active() sets clcsock-\u003esk_user_data\\nto NULL under sk_callback_lock, and then the smc_sock itself\\ncan be freed via sock_put() in smc_release().\\n\\nThis leads to two issues:\\n\\n1) NULL pointer dereference: sk_user_data is NULL when\\n   accessed.\\n2) Use-after-free: sk_user_data is read as non-NULL, but the\\n   smc_sock is freed before its fields (e.g., queued_smc_hs,\\n   ori_af_ops) are accessed.\\n\\nThe race window looks like this (the syzkaller crash [1]\\ntriggers via the SYN cookie path: tcp_get_cookie_sock() -\u003e\\nsmc_tcp_syn_recv_sock(), but the normal tcp_check_req() path\\nhas the same race):\\n\\n  CPU A (softirq)              CPU B (process ctx)\\n\\n  tcp_v4_rcv()\\n    TCP_NEW_SYN_RECV:\\n    sk = req-\u003ersk_listener\\n    sock_hold(sk)\\n    /* No lock on listener */\\n                               smc_close_active():\\n                                 write_lock_bh(cb_lock)\\n                                 sk_user_data = NULL\\n                                 write_unlock_bh(cb_lock)\\n                                 ...\\n                                 smc_clcsock_release()\\n                                 sock_put(smc-\u003esk) x2\\n                                   -\u003e smc_sock freed!\\n    tcp_check_req()\\n      smc_tcp_syn_recv_sock():\\n        smc = user_data(sk)\\n          -\u003e NULL or dangling\\n        smc-\u003equeued_smc_hs\\n          -\u003e crash!\\n\\nNote that the clcsock and smc_sock are two independent objects\\nwith separate refcounts. TCP stack holds a reference on the\\nclcsock, which keeps it alive, but this does NOT prevent the\\nsmc_sock from being freed.\\n\\nFix this by using RCU and refcount_inc_not_zero() to safely\\naccess smc_sock. Since smc_tcp_syn_recv_sock() is called in\\nthe TCP three-way handshake path, taking read_lock_bh on\\nsk_callback_lock is too heavy and would not survive a SYN\\nflood attack. Using rcu_read_lock() is much more lightweight.\\n\\n- Set SOCK_RCU_FREE on the SMC listen socket so that\\n  smc_sock freeing is deferred until after the RCU grace\\n  period. This guarantees the memory is still valid when\\n  accessed inside rcu_read_lock().\\n- Use rcu_read_lock() to protect reading sk_user_data.\\n- Use refcount_inc_not_zero(\u0026smc-\u003esk.sk_refcnt) to pin the\\n  smc_sock. If the refcount has already reached zero (close\\n  path completed), it returns false and we bail out safely.\\n\\nNote: smc_hs_congested() has a similar lockless read of\\nsk_user_data without rcu_read_lock(), but it only checks for\\nNULL and accesses the global smc_hs_wq, never dereferencing\\nany smc_sock field, so it is not affected.\\n\\nReproducer was verified with mdelay injection and smc_run,\\nthe issue no longer occurs with this patch applied.\\n\\n[1] https://syzkaller.appspot.com/bug?extid=827ae2bfb3a3529333e9\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nnet/smc: corrige la desreferencia de NULL y el UAF en smc_tcp_syn_recv_sock()\\n\\nSyzkaller inform\u00f3 un p\u00e1nico en smc_tcp_syn_recv_sock() [1].\\n\\nsmc_tcp_syn_recv_sock() se llama en la ruta de recepci\u00f3n TCP (softirq) a trav\u00e9s de icsk_af_ops -\u003e syn_recv_sock en el clcsock (socket de escucha TCP). Lee sk_user_data para obtener el puntero smc_sock. Sin embargo, cuando el socket de escucha SMC se est\u00e1 cerrando concurrentemente, smc_close_active() establece clcsock -\u003e sk_user_data en NULL bajo sk_callback_lock, y luego el propio smc_sock puede ser liberado a trav\u00e9s de sock_put() en smc_release().\\n\\nEsto lleva a dos problemas:\\n\\n1) Desreferencia de puntero NULL: sk_user_data es NULL cuando se accede.\\n2) Uso despu\u00e9s de liberaci\u00f3n: sk_user_data se lee como no-NULL, pero el smc_sock es liberado antes de que se acceda a sus campos (por ejemplo, queued_smc_hs, ori_af_ops).\\n\\nLa ventana de carrera se ve as\u00ed (el fallo de syzkaller [1] se activa a trav\u00e9s de la ruta de la cookie SYN: tcp_get_cookie_sock()  -\u003e  smc_tcp_syn_recv_sock(), pero la ruta normal de tcp_check_req() tiene la misma carrera):\\n\\n  CPU A (softirq)              CPU B (contexto de proceso)\\n\\n  tcp_v4_rcv()\\n    TCP_NEW_SYN_RECV:\\n    sk = req -\u003e rsk_listener\\n    sock_hold(sk)\\n    /* Sin bloqueo en el oyente */\\n                               smc_close_active():\\n                                 write_lock_bh(cb_lock)\\n                                 sk_user_data = NULL\\n                                 write_unlock_bh(cb_lock)\\n                                 ...\\n                                 smc_clcsock_release()\\n                                 sock_put(smc -\u003e sk) x2\\n                                    -\u003e  \u00a1smc_sock liberado!\\n    tcp_check_req()\\n      smc_tcp_syn_recv_sock():\\n        smc = user_data(sk)\\n           -\u003e  NULL o colgante\\n        smc -\u003e queued_smc_hs\\n           -\u003e  \u00a1fallo!\\n\\nTenga en cuenta que el clcsock y el smc_sock son dos objetos independientes con recuentos de referencia separados. La pila TCP mantiene una referencia en el clcsock, lo que lo mantiene vivo, pero esto NO evita que el smc_sock sea liberado.\\n\\nSolucione esto utilizando RCU y refcount_inc_not_zero() para acceder de forma segura a smc_sock. Dado que smc_tcp_syn_recv_sock() se llama en la ruta del handshake de tres v\u00edas de TCP, tomar read_lock_bh en sk_callback_lock es demasiado pesado y no sobrevivir\u00eda a un ataque de inundaci\u00f3n SYN. Usar rcu_read_lock() es mucho m\u00e1s ligero.\\n\\n- Establezca SOCK_RCU_FREE en el socket de escucha SMC para que la liberaci\u00f3n de smc_sock se posponga hasta despu\u00e9s del per\u00edodo de gracia de RCU. Esto garantiza que la memoria sigue siendo v\u00e1lida cuando se accede dentro de rcu_read_lock().\\n- Use rcu_read_lock() para proteger la lectura de sk_user_data.\\n- Use refcount_inc_not_zero(\u0026smc -\u003e sk.sk_refcnt) para fijar el smc_sock. Si el recuento de referencias ya ha llegado a cero (ruta de cierre completada), devuelve falso y salimos de forma segura.\\n\\nNota: smc_hs_congested() tiene una lectura similar sin bloqueo de sk_user_data sin rcu_read_lock(), pero solo verifica si es NULL y accede al smc_hs_wq global, nunca desreferenciando ning\u00fan campo de smc_sock, por lo que no se ve afectado.\\n\\nEl reproductor fue verificado con inyecci\u00f3n de mdelay y smc_run, el problema ya no ocurre con este parche aplicado.\\n\\n[1] https://syzkaller.appspot.com/bug?extid=827ae2bfb3a3529333e9\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/smc/af_smc.c\",\"net/smc/smc.h\",\"net/smc/smc_close.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"ebfee3e153f67c8b38eb94a7062ee94aa6f92708\",\"lessThan\":\"f315277856caeafcd996c2611afc085ca2d53275\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8270d9c21041470f58348248b9d9dcf3bf79592e\",\"lessThan\":\"1e4f873879e075bbd4eb1c644d6933303ac5eba4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8270d9c21041470f58348248b9d9dcf3bf79592e\",\"lessThan\":\"f00fc26c8a06442b225a350fe000c0a11483e6a3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8270d9c21041470f58348248b9d9dcf3bf79592e\",\"lessThan\":\"cadf3da46c15523fba90d80c9955f536ee3b4023\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8270d9c21041470f58348248b9d9dcf3bf79592e\",\"lessThan\":\"fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8270d9c21041470f58348248b9d9dcf3bf79592e\",\"lessThan\":\"1fab5ece76fb42a761178dcd0ebcbf578377b0dd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8270d9c21041470f58348248b9d9dcf3bf79592e\",\"lessThan\":\"6d5e4538364b9ceb1ac2941a4deb86650afb3538\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.15.174\",\"lessThan\":\"5.15.203\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/smc/af_smc.c\",\"net/smc/smc.h\",\"net/smc/smc_close.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.203\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.167\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.130\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.78\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.20\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.10\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]},{\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\",\"affectedData\":[{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.5\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.5\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.5\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.5\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.6\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]},{\"vendor\":\"Siemens\",\"product\":\"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP\",\"defaultStatus\":\"unknown\",\"versions\":[{\"version\":\"V3.1.5\",\"lessThan\":\"*\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.174\",\"versionEndExcluding\":\"5.15.203\",\"matchCriteriaId\":\"A010E017-5B8B-4998-95E7-D76376A71A62\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.18\",\"versionEndExcluding\":\"6.1.167\",\"matchCriteriaId\":\"25D24035-467E-4E84-987E-DA8067ECEAC4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.130\",\"matchCriteriaId\":\"C57BB918-DF28-46B3-94F7-144176841267\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.78\",\"matchCriteriaId\":\"28D591F5-B196-4CC9-905C-DC80F116E7A8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.20\",\"matchCriteriaId\":\"E5571059-6552-48E7-9BEF-3E358C387171\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.10\",\"matchCriteriaId\":\"96D34333-38BE-4414-9E79-6EB764329581\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F666C8D8-6538-46D4-B318-87610DE64C34\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"02259FDA-961B-47BC-AE7F-93D7EC6E90C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"58A9FEFF-C040-420D-8F0A-BFDAAA1DF258\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-019113.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"},{\"url\":\"https://cert-portal.siemens.com/productcert/html/ssa-082556.html\",\"source\":\"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-30T11:46:02+00:00",
      "cve": "CVE-2026-23450",
      "id": "CVE-2026-23450",
      "initial_release_date": "2026-04-03T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23450.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-07-19T17:42:16Z",
      "cve": "CVE-2026-23450",
      "id": "CVE-2026-23450",
      "initial_release_date": "2026-04-03T23:27:32Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "405",
      "product_status:known_not_affected": "136",
      "product_status:recommended": "394",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-23450",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-23450.json",
      "version": "23"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.