CVE-2026-64005 (GCVE-0-2026-64005)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:56 – Updated: 2026-08-05 12:38
VLAI
Title
net/smc: Do not re-initialize smc hashtables
Summary
In the Linux kernel, the following vulnerability has been resolved: net/smc: Do not re-initialize smc hashtables INIT_HLIST_HEAD(&smc_v*_hashinfo.ht) are called after smc_nl_init(), proto_register() and sock_register(). This can lead to smc_v*_hashinfo.ht being reset even though hash entries already exist and are being used, possibly resulting in a corrupted list. Remove unnecessary and dangerous re-initialisation of smc_v*_hashinfo.ht in smc_init(); it is implicitly initialised to zero anyhow. Add HLIST_HEAD_INIT to the definitions for clarity.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: f16a7dd5cf27eeda187425c9c7d96802a549f9c4 , < cdc79c05cc375f68ae87b0c74fdaac1a5c93155a (git)
Affected: f16a7dd5cf27eeda187425c9c7d96802a549f9c4 , < 2006605006e5a4a11d93e1ebdbbe95764d24276f (git)
Affected: f16a7dd5cf27eeda187425c9c7d96802a549f9c4 , < 64c96e497d5ada0b90e99bf58f893aa2b73dcfbc (git)
Affected: f16a7dd5cf27eeda187425c9c7d96802a549f9c4 , < ed7a758313011885347b854e97cb95903ef3c3f7 (git)
Affected: f16a7dd5cf27eeda187425c9c7d96802a549f9c4 , < 0cc9d0ac22d02f1ba1884de5d6de9eaf8b45d82d (git)
Affected: f16a7dd5cf27eeda187425c9c7d96802a549f9c4 , < 55cba6b883b41e5922c00ba9d4e3262131f46f1b (git)
Affected: f16a7dd5cf27eeda187425c9c7d96802a549f9c4 , < 5ec939367e700722ffbb1b7cacccbb1a3cf0ebd1 (git)
Affected: f16a7dd5cf27eeda187425c9c7d96802a549f9c4 , < 9e4389b0038781f19f97895186ed941ff8ac1678 (git)
Create a notification for this product.
Linux Linux Affected: 4.11
Unaffected: 0 , < 4.11 (semver)
Unaffected: 5.10.259 , ≤ 5.10.* (semver)
Unaffected: 5.15.210 , ≤ 5.15.* (semver)
Unaffected: 6.1.176 , ≤ 6.1.* (semver)
Unaffected: 6.6.143 , ≤ 6.6.* (semver)
Unaffected: 6.12.93 , ≤ 6.12.* (semver)
Unaffected: 6.18.35 , ≤ 6.18.* (semver)
Unaffected: 7.0.12 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/smc/af_smc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "cdc79c05cc375f68ae87b0c74fdaac1a5c93155a",
              "status": "affected",
              "version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4",
              "versionType": "git"
            },
            {
              "lessThan": "2006605006e5a4a11d93e1ebdbbe95764d24276f",
              "status": "affected",
              "version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4",
              "versionType": "git"
            },
            {
              "lessThan": "64c96e497d5ada0b90e99bf58f893aa2b73dcfbc",
              "status": "affected",
              "version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4",
              "versionType": "git"
            },
            {
              "lessThan": "ed7a758313011885347b854e97cb95903ef3c3f7",
              "status": "affected",
              "version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4",
              "versionType": "git"
            },
            {
              "lessThan": "0cc9d0ac22d02f1ba1884de5d6de9eaf8b45d82d",
              "status": "affected",
              "version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4",
              "versionType": "git"
            },
            {
              "lessThan": "55cba6b883b41e5922c00ba9d4e3262131f46f1b",
              "status": "affected",
              "version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4",
              "versionType": "git"
            },
            {
              "lessThan": "5ec939367e700722ffbb1b7cacccbb1a3cf0ebd1",
              "status": "affected",
              "version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4",
              "versionType": "git"
            },
            {
              "lessThan": "9e4389b0038781f19f97895186ed941ff8ac1678",
              "status": "affected",
              "version": "f16a7dd5cf27eeda187425c9c7d96802a549f9c4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/smc/af_smc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.11"
            },
            {
              "lessThan": "4.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "4.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: Do not re-initialize smc hashtables\n\nINIT_HLIST_HEAD(\u0026smc_v*_hashinfo.ht) are called after smc_nl_init(),\nproto_register() and sock_register(). This can lead to smc_v*_hashinfo.ht\nbeing reset even though hash entries already exist and are being used,\npossibly resulting in a corrupted list.\n\nRemove unnecessary and dangerous re-initialisation of smc_v*_hashinfo.ht in\nsmc_init(); it is implicitly initialised to zero anyhow. Add\nHLIST_HEAD_INIT to the definitions for clarity."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires winning a race during SMC module initialization by concurrently calling socket(PF_SMC)/socket(AF_INET, SOCK_STREAM, IPPROTO_SMC) syscalls. The bug is not reachable from remote network packet handling; SMC network upgrade paths operate only after initialization completes.\nAC:L - An attacker controls both sides of the race by spawning concurrent threads that hammer socket creation while another thread triggers SMC module autoload via request_module(\"net-pf-43\") during sock_register(). The vulnerable window between sock_register() and INIT_HLIST_HEAD() is narrow but attacker-driven and repeatable on each module load/reload.\nPR:L - Creating PF_SMC or IPPROTO_SMC sockets requires only an unprivileged local user account; no CAP_NET_ADMIN, CAP_SYS_MODULE, or real root in the initial namespace is needed to participate in the race when module autoload is enabled. Triggering module load may require admin action on hardened systems, but the corrupting socket operations themselves need only basic local privileges.\nUI:N - No victim interaction is required beyond the attacker\u0027s own concurrent socket creation during module initialization; no mount, file open, or other user action is needed.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security boundary; this is not a VM escape, IOMMU bypass, or cross-authority sandbox escape.\nC:H - Resetting smc_v4/v6_hashinfo.ht after sockets are hashed orphans live sk_node entries; subsequent hlist traversal in smc_diag_dump_proto() or corrupted pointer chasing can read arbitrary kernel memory adjacent to socket structures.\nI:H - Orphaned hlist nodes cause __hlist_del() in smc_unhash_sk() to write through stale pprev/next pointers when corrupted sockets are closed, enabling exploitable kernel heap/list corruption and potential control-flow hijacking.\nA:H - List corruption reliably causes kernel oops or panic when orphaned sockets are unhashed (__hlist_del with NULL next) or when the corrupted hashtable is walked, resulting in complete loss of kernel availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:38:05.933Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/cdc79c05cc375f68ae87b0c74fdaac1a5c93155a"
        },
        {
          "url": "https://git.kernel.org/stable/c/2006605006e5a4a11d93e1ebdbbe95764d24276f"
        },
        {
          "url": "https://git.kernel.org/stable/c/64c96e497d5ada0b90e99bf58f893aa2b73dcfbc"
        },
        {
          "url": "https://git.kernel.org/stable/c/ed7a758313011885347b854e97cb95903ef3c3f7"
        },
        {
          "url": "https://git.kernel.org/stable/c/0cc9d0ac22d02f1ba1884de5d6de9eaf8b45d82d"
        },
        {
          "url": "https://git.kernel.org/stable/c/55cba6b883b41e5922c00ba9d4e3262131f46f1b"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ec939367e700722ffbb1b7cacccbb1a3cf0ebd1"
        },
        {
          "url": "https://git.kernel.org/stable/c/9e4389b0038781f19f97895186ed941ff8ac1678"
        }
      ],
      "title": "net/smc: Do not re-initialize smc hashtables",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64005",
    "datePublished": "2026-07-19T14:56:21.608Z",
    "dateReserved": "2026-07-19T07:54:57.026Z",
    "dateUpdated": "2026-08-05T12:38:05.933Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64005",
      "date": "2026-08-10",
      "epss": "0.00129",
      "percentile": "0.02932"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64005\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-19T16:17:40.170\",\"lastModified\":\"2026-07-30T14:51:11.223\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/smc: Do not re-initialize smc hashtables\\n\\nINIT_HLIST_HEAD(\u0026smc_v*_hashinfo.ht) are called after smc_nl_init(),\\nproto_register() and sock_register(). This can lead to smc_v*_hashinfo.ht\\nbeing reset even though hash entries already exist and are being used,\\npossibly resulting in a corrupted list.\\n\\nRemove unnecessary and dangerous re-initialisation of smc_v*_hashinfo.ht in\\nsmc_init(); it is implicitly initialised to zero anyhow. Add\\nHLIST_HEAD_INIT to the definitions for clarity.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/smc/af_smc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f16a7dd5cf27eeda187425c9c7d96802a549f9c4\",\"lessThan\":\"cdc79c05cc375f68ae87b0c74fdaac1a5c93155a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f16a7dd5cf27eeda187425c9c7d96802a549f9c4\",\"lessThan\":\"2006605006e5a4a11d93e1ebdbbe95764d24276f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f16a7dd5cf27eeda187425c9c7d96802a549f9c4\",\"lessThan\":\"64c96e497d5ada0b90e99bf58f893aa2b73dcfbc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f16a7dd5cf27eeda187425c9c7d96802a549f9c4\",\"lessThan\":\"ed7a758313011885347b854e97cb95903ef3c3f7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f16a7dd5cf27eeda187425c9c7d96802a549f9c4\",\"lessThan\":\"0cc9d0ac22d02f1ba1884de5d6de9eaf8b45d82d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f16a7dd5cf27eeda187425c9c7d96802a549f9c4\",\"lessThan\":\"55cba6b883b41e5922c00ba9d4e3262131f46f1b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f16a7dd5cf27eeda187425c9c7d96802a549f9c4\",\"lessThan\":\"5ec939367e700722ffbb1b7cacccbb1a3cf0ebd1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f16a7dd5cf27eeda187425c9c7d96802a549f9c4\",\"lessThan\":\"9e4389b0038781f19f97895186ed941ff8ac1678\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/smc/af_smc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.11\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.11\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.259\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.210\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.176\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.143\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.93\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.35\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.12\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0cc9d0ac22d02f1ba1884de5d6de9eaf8b45d82d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2006605006e5a4a11d93e1ebdbbe95764d24276f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/55cba6b883b41e5922c00ba9d4e3262131f46f1b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5ec939367e700722ffbb1b7cacccbb1a3cf0ebd1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/64c96e497d5ada0b90e99bf58f893aa2b73dcfbc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9e4389b0038781f19f97895186ed941ff8ac1678\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cdc79c05cc375f68ae87b0c74fdaac1a5c93155a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ed7a758313011885347b854e97cb95903ef3c3f7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-22T07:06:10+00:00",
      "cve": "CVE-2026-64005",
      "id": "CVE-2026-64005",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/smc: Do not re-initialize smc hashtables",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64005.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-06T01:10:29Z",
      "cve": "CVE-2026-64005",
      "id": "CVE-2026-64005",
      "initial_release_date": "2026-07-21T13:01:43Z",
      "product_status:known_affected": "298",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64005",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64005.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.