GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80981 (GCVE-0-2026-80981)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:42 – Updated: 2026-09-13 06:28
VLAI
Title
net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link()
Summary
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() smc_llc_srv_add_link() keeps add_llc pointing into the queue entry: add_llc = &qentry->msg.add_link; smc_llc.c:1482 ... smc_llc_save_add_link_info(link_new, add_llc); smc_llc.c:1494 smc_llc_flow_qentry_del(&lgr->llc_flow_lcl); smc_llc.c:1495 ... u8 *llc_msg = smc_link_shared_v2_rxbuf(link) ? (u8 *)lgr->wr_rx_buf_v2 : (u8 *)add_llc; smc_llc.c:1504 smc_llc_save_add_link_rkeys(link, link_new, llc_msg); smc_llc.c:1506 smc_llc_flow_qentry_del() kfree()s the entry, so on a link without a shared v2 receive buffer the pointer handed to smc_llc_save_add_link_rkeys() is already freed. Before the Fixes: commit that branch always used lgr->wr_rx_buf_v2 and add_llc was not used after the free. Reproduced on an unpatched tree over rxe, with KASAN, kasan_multi_shot and a link forced to max_recv_sge == 1: the entry is freed and read by the same call, and the freeing frame is smc_llc_srv_add_link() itself. [ 2.523161] BUG: KASAN: slab-use-after-free in smc_llc_save_add_link_rkeys+0x333/0x350 [ 2.523499] Read of size 2 at addr ffff8880052194de by task kworker/0:1/11 [ 2.523789] [ 2.523862] CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 7.2.0-rc5-p0-g2c9dd296545d #35 PREEMPT(lazy) [ 2.523865] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2.523866] Workqueue: smc_hs_wq smc_listen_work [ 2.523869] Call Trace: [ 2.523870] <TASK> [ 2.523871] dump_stack_lvl+0x53/0x70 [ 2.523872] print_report+0xd0/0x630 [ 2.523874] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 2.523876] ? smc_llc_save_add_link_rkeys+0x333/0x350 [ 2.523878] kasan_report+0xce/0x100 [ 2.523879] ? smc_llc_save_add_link_rkeys+0x333/0x350 [ 2.523881] smc_llc_save_add_link_rkeys+0x333/0x350 [ 2.523883] ? smcr_buf_reg_lgr+0x2a4/0x660 [ 2.523885] smc_llc_srv_add_link+0xaa2/0x1e50 [ 2.523888] ? _printk+0xba/0xf0 [ 2.523897] ? __pfx_smc_llc_srv_add_link+0x10/0x10 [ 2.523899] ? down_write+0xb0/0x130 [ 2.523903] ? __pfx_down_write+0x10/0x10 [ 2.523905] smc_listen_work+0x489e/0x4d00 [ 2.523907] ? kmem_cache_free+0x1c6/0x3a0 [ 2.523911] ? __pfx_smc_listen_work+0x10/0x10 [ 2.523913] ? release_sock+0x148/0x1d0 [ 2.523915] ? smc_tcp_listen_work+0xb4f/0xfc0 [ 2.523917] ? _raw_spin_lock_irq+0x80/0xe0 [ 2.523918] ? __pfx__raw_spin_lock_irq+0x10/0x10 [ 2.523920] process_one_work+0x633/0x1030 [ 2.523922] ? assign_work+0x11d/0x370 [ 2.523924] worker_thread+0x45b/0xd10 [ 2.523926] ? __pfx_worker_thread+0x10/0x10 [ 2.523928] ? __pfx_worker_thread+0x10/0x10 [ 2.523929] kthread+0x2c6/0x3b0 [ 2.523931] ? recalc_sigpending+0x15c/0x1e0 [ 2.523934] ? __pfx_kthread+0x10/0x10 [ 2.523935] ret_from_fork+0x36e/0x5a0 [ 2.523937] ? __pfx_ret_from_fork+0x10/0x10 [ 2.523938] ? __switch_to+0x572/0xdd0 [ 2.523943] ? __pfx_kthread+0x10/0x10 [ 2.523944] ret_from_fork_asm+0x1a/0x30 [ 2.523947] </TASK> [ 2.523948] [ 2.531253] Allocated by task 48: [ 2.531399] kasan_save_stack+0x33/0x60 [ 2.531570] kasan_save_track+0x14/0x30 [ 2.531737] __kasan_kmalloc+0x8f/0xa0 [ 2.531905] __kmalloc_cache_noprof+0x158/0x370 [ 2.532100] smc_llc_enqueue+0x72/0x560 [ 2.532268] smc_wr_rx_tasklet_fn+0x474/0xa80 [ 2.532491] tasklet_action_common+0x20f/0x8a0 [ 2.532714] handle_softirqs+0x18e/0x590 [ 2.532886] do_softirq+0x3b/0x60 [ 2.533036] __local_bh_enable_ip+0x61/0x70 [ 2.533221] __alloc_skb+0x732/0x890 [ 2.533384] rxe_init_packet+0x16b/0x4f0 [ 2.533567] prepare_ack_packet+0xb8/0x830 [ 2.533760] rxe_receiver+0x495/0x96e0 [ 2.533933] do_work+0x144/0x470 [ 2 ---truncated---
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 27ef6a9981fe74191849966a6d5e0400a4008ab8 , < c52a998a223e7e84333306996edec096178d1e95 (git)
Affected: 27ef6a9981fe74191849966a6d5e0400a4008ab8 , < adef84cc85d449ac28d2b4b4c49cf19619c56e27 (git)
Affected: 27ef6a9981fe74191849966a6d5e0400a4008ab8 , < a42a459ef0e54cb0c4b3e43e21cb0e658e664f64 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/smc/smc_llc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c52a998a223e7e84333306996edec096178d1e95",
              "status": "affected",
              "version": "27ef6a9981fe74191849966a6d5e0400a4008ab8",
              "versionType": "git"
            },
            {
              "lessThan": "adef84cc85d449ac28d2b4b4c49cf19619c56e27",
              "status": "affected",
              "version": "27ef6a9981fe74191849966a6d5e0400a4008ab8",
              "versionType": "git"
            },
            {
              "lessThan": "a42a459ef0e54cb0c4b3e43e21cb0e658e664f64",
              "status": "affected",
              "version": "27ef6a9981fe74191849966a6d5e0400a4008ab8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/smc/smc_llc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link()\n\nsmc_llc_srv_add_link() keeps add_llc pointing into the queue entry:\n\n  add_llc = \u0026qentry-\u003emsg.add_link;\t\t\tsmc_llc.c:1482\n  ...\n  smc_llc_save_add_link_info(link_new, add_llc);\tsmc_llc.c:1494\n  smc_llc_flow_qentry_del(\u0026lgr-\u003ellc_flow_lcl);\t\tsmc_llc.c:1495\n  ...\n  u8 *llc_msg = smc_link_shared_v2_rxbuf(link) ?\n\t(u8 *)lgr-\u003ewr_rx_buf_v2 : (u8 *)add_llc;\tsmc_llc.c:1504\n  smc_llc_save_add_link_rkeys(link, link_new, llc_msg);\tsmc_llc.c:1506\n\nsmc_llc_flow_qentry_del() kfree()s the entry, so on a link without a shared\nv2 receive buffer the pointer handed to smc_llc_save_add_link_rkeys() is\nalready freed. Before the Fixes: commit that branch always used\nlgr-\u003ewr_rx_buf_v2 and add_llc was not used after the free.\n\nReproduced on an unpatched tree over rxe, with KASAN, kasan_multi_shot\nand a link forced to max_recv_sge == 1: the entry is freed and read by\nthe same call, and the freeing frame is smc_llc_srv_add_link() itself.\n\n  [    2.523161] BUG: KASAN: slab-use-after-free in smc_llc_save_add_link_rkeys+0x333/0x350\n  [    2.523499] Read of size 2 at addr ffff8880052194de by task kworker/0:1/11\n  [    2.523789]\n  [    2.523862] CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 7.2.0-rc5-p0-g2c9dd296545d #35 PREEMPT(lazy)\n  [    2.523865] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n  [    2.523866] Workqueue: smc_hs_wq smc_listen_work\n  [    2.523869] Call Trace:\n  [    2.523870]  \u003cTASK\u003e\n  [    2.523871]  dump_stack_lvl+0x53/0x70\n  [    2.523872]  print_report+0xd0/0x630\n  [    2.523874]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n  [    2.523876]  ? smc_llc_save_add_link_rkeys+0x333/0x350\n  [    2.523878]  kasan_report+0xce/0x100\n  [    2.523879]  ? smc_llc_save_add_link_rkeys+0x333/0x350\n  [    2.523881]  smc_llc_save_add_link_rkeys+0x333/0x350\n  [    2.523883]  ? smcr_buf_reg_lgr+0x2a4/0x660\n  [    2.523885]  smc_llc_srv_add_link+0xaa2/0x1e50\n  [    2.523888]  ? _printk+0xba/0xf0\n  [    2.523897]  ? __pfx_smc_llc_srv_add_link+0x10/0x10\n  [    2.523899]  ? down_write+0xb0/0x130\n  [    2.523903]  ? __pfx_down_write+0x10/0x10\n  [    2.523905]  smc_listen_work+0x489e/0x4d00\n  [    2.523907]  ? kmem_cache_free+0x1c6/0x3a0\n  [    2.523911]  ? __pfx_smc_listen_work+0x10/0x10\n  [    2.523913]  ? release_sock+0x148/0x1d0\n  [    2.523915]  ? smc_tcp_listen_work+0xb4f/0xfc0\n  [    2.523917]  ? _raw_spin_lock_irq+0x80/0xe0\n  [    2.523918]  ? __pfx__raw_spin_lock_irq+0x10/0x10\n  [    2.523920]  process_one_work+0x633/0x1030\n  [    2.523922]  ? assign_work+0x11d/0x370\n  [    2.523924]  worker_thread+0x45b/0xd10\n  [    2.523926]  ? __pfx_worker_thread+0x10/0x10\n  [    2.523928]  ? __pfx_worker_thread+0x10/0x10\n  [    2.523929]  kthread+0x2c6/0x3b0\n  [    2.523931]  ? recalc_sigpending+0x15c/0x1e0\n  [    2.523934]  ? __pfx_kthread+0x10/0x10\n  [    2.523935]  ret_from_fork+0x36e/0x5a0\n  [    2.523937]  ? __pfx_ret_from_fork+0x10/0x10\n  [    2.523938]  ? __switch_to+0x572/0xdd0\n  [    2.523943]  ? __pfx_kthread+0x10/0x10\n  [    2.523944]  ret_from_fork_asm+0x1a/0x30\n  [    2.523947]  \u003c/TASK\u003e\n  [    2.523948]\n  [    2.531253] Allocated by task 48:\n  [    2.531399]  kasan_save_stack+0x33/0x60\n  [    2.531570]  kasan_save_track+0x14/0x30\n  [    2.531737]  __kasan_kmalloc+0x8f/0xa0\n  [    2.531905]  __kmalloc_cache_noprof+0x158/0x370\n  [    2.532100]  smc_llc_enqueue+0x72/0x560\n  [    2.532268]  smc_wr_rx_tasklet_fn+0x474/0xa80\n  [    2.532491]  tasklet_action_common+0x20f/0x8a0\n  [    2.532714]  handle_softirqs+0x18e/0x590\n  [    2.532886]  do_softirq+0x3b/0x60\n  [    2.533036]  __local_bh_enable_ip+0x61/0x70\n  [    2.533221]  __alloc_skb+0x732/0x890\n  [    2.533384]  rxe_init_packet+0x16b/0x4f0\n  [    2.533567]  prepare_ack_packet+0xb8/0x830\n  [    2.533760]  rxe_receiver+0x495/0x96e0\n  [    2.533933]  do_work+0x144/0x470\n  [    2\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The UAF is reached from smc_listen_work() (smc_listen_rdma_finish \u2192 smcr_serv_conf_first_link \u2192 smc_llc_srv_add_link) and from LLC ADD_LINK handling; CLC is plain TCP and SMC-Rv2/RoCEv2 LLC messages are IP-routable (UDP/4791), so a remote peer that can reach an AF_SMC listener drives the path.\nAC:L - The kfree of the LLC qentry and the later read in smc_llc_save_add_link_rkeys() run sequentially in the same call with no race; on an affected SMC-Rv2 link (max_recv_sge==1, the devices this bug exists for) a connecting peer that completes first-contact and replies to ADD_LINK triggers it reliably.\nPR:N - smc_listen_work() runs the CLC/LLC handshake after TCP accept and before accept() returns to userspace; SMC authenticates nothing, and smc_create()/smc_listen() enforce no capabilities, so an unauthenticated network peer needs only reachability to the listener.\nUI:N - The listen worker is queued automatically from smc_tcp_listen_work() for inbound connections; no local user action such as mounting a filesystem or opening a file is required.\nS:U - The use-after-free corrupts kernel heap state (the kmalloc-96 LLC qentry and link-group rtoken tables) within the same host kernel security authority; it is not a VM escape, IOMMU bypass, or sandbox boundary crossing.\nC:H - The dangling add_llc pointer is a use-after-free read of a freed kmalloc-96 qentry (KASAN: slab-use-after-free in smc_llc_save_add_link_rkeys); per kernel CNA guidance a UAF of a generic slab object enables arbitrary kernel memory disclosure via heap reuse.\nI:H - smc_ib_ready_link()/smcr_buf_reg_lgr() allocate between the free and the UAF, so the object can be sprayed; smc_llc_save_add_link_rkeys() then writes those bytes into lgr-\u003ertokens, a UAF-backed write primitive usable for arbitrary kernel modification or control-flow hijack.\nA:H - KASAN reports slab-use-after-free in smc_llc_save_add_link_rkeys() from smc_listen_work on smc_hs_wq; dereferencing freed heap from that kworker oopses or panics the kernel, and a remote peer can repeat the handshake at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:28:47.705Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c52a998a223e7e84333306996edec096178d1e95"
        },
        {
          "url": "https://git.kernel.org/stable/c/adef84cc85d449ac28d2b4b4c49cf19619c56e27"
        },
        {
          "url": "https://git.kernel.org/stable/c/a42a459ef0e54cb0c4b3e43e21cb0e658e664f64"
        }
      ],
      "title": "net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80981",
    "datePublished": "2026-09-11T19:42:41.543Z",
    "dateReserved": "2026-08-26T14:34:25.811Z",
    "dateUpdated": "2026-09-13T06:28:47.705Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80981",
      "date": "2026-09-16",
      "epss": "0.00588",
      "percentile": "0.46574"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80981\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:04.520\",\"lastModified\":\"2026-09-13T07:17:05.000\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link()\\n\\nsmc_llc_srv_add_link() keeps add_llc pointing into the queue entry:\\n\\n  add_llc = \u0026qentry-\u003emsg.add_link;\\t\\t\\tsmc_llc.c:1482\\n  ...\\n  smc_llc_save_add_link_info(link_new, add_llc);\\tsmc_llc.c:1494\\n  smc_llc_flow_qentry_del(\u0026lgr-\u003ellc_flow_lcl);\\t\\tsmc_llc.c:1495\\n  ...\\n  u8 *llc_msg = smc_link_shared_v2_rxbuf(link) ?\\n\\t(u8 *)lgr-\u003ewr_rx_buf_v2 : (u8 *)add_llc;\\tsmc_llc.c:1504\\n  smc_llc_save_add_link_rkeys(link, link_new, llc_msg);\\tsmc_llc.c:1506\\n\\nsmc_llc_flow_qentry_del() kfree()s the entry, so on a link without a shared\\nv2 receive buffer the pointer handed to smc_llc_save_add_link_rkeys() is\\nalready freed. Before the Fixes: commit that branch always used\\nlgr-\u003ewr_rx_buf_v2 and add_llc was not used after the free.\\n\\nReproduced on an unpatched tree over rxe, with KASAN, kasan_multi_shot\\nand a link forced to max_recv_sge == 1: the entry is freed and read by\\nthe same call, and the freeing frame is smc_llc_srv_add_link() itself.\\n\\n  [    2.523161] BUG: KASAN: slab-use-after-free in smc_llc_save_add_link_rkeys+0x333/0x350\\n  [    2.523499] Read of size 2 at addr ffff8880052194de by task kworker/0:1/11\\n  [    2.523789]\\n  [    2.523862] CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 7.2.0-rc5-p0-g2c9dd296545d #35 PREEMPT(lazy)\\n  [    2.523865] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\\n  [    2.523866] Workqueue: smc_hs_wq smc_listen_work\\n  [    2.523869] Call Trace:\\n  [    2.523870]  \u003cTASK\u003e\\n  [    2.523871]  dump_stack_lvl+0x53/0x70\\n  [    2.523872]  print_report+0xd0/0x630\\n  [    2.523874]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\\n  [    2.523876]  ? smc_llc_save_add_link_rkeys+0x333/0x350\\n  [    2.523878]  kasan_report+0xce/0x100\\n  [    2.523879]  ? smc_llc_save_add_link_rkeys+0x333/0x350\\n  [    2.523881]  smc_llc_save_add_link_rkeys+0x333/0x350\\n  [    2.523883]  ? smcr_buf_reg_lgr+0x2a4/0x660\\n  [    2.523885]  smc_llc_srv_add_link+0xaa2/0x1e50\\n  [    2.523888]  ? _printk+0xba/0xf0\\n  [    2.523897]  ? __pfx_smc_llc_srv_add_link+0x10/0x10\\n  [    2.523899]  ? down_write+0xb0/0x130\\n  [    2.523903]  ? __pfx_down_write+0x10/0x10\\n  [    2.523905]  smc_listen_work+0x489e/0x4d00\\n  [    2.523907]  ? kmem_cache_free+0x1c6/0x3a0\\n  [    2.523911]  ? __pfx_smc_listen_work+0x10/0x10\\n  [    2.523913]  ? release_sock+0x148/0x1d0\\n  [    2.523915]  ? smc_tcp_listen_work+0xb4f/0xfc0\\n  [    2.523917]  ? _raw_spin_lock_irq+0x80/0xe0\\n  [    2.523918]  ? __pfx__raw_spin_lock_irq+0x10/0x10\\n  [    2.523920]  process_one_work+0x633/0x1030\\n  [    2.523922]  ? assign_work+0x11d/0x370\\n  [    2.523924]  worker_thread+0x45b/0xd10\\n  [    2.523926]  ? __pfx_worker_thread+0x10/0x10\\n  [    2.523928]  ? __pfx_worker_thread+0x10/0x10\\n  [    2.523929]  kthread+0x2c6/0x3b0\\n  [    2.523931]  ? recalc_sigpending+0x15c/0x1e0\\n  [    2.523934]  ? __pfx_kthread+0x10/0x10\\n  [    2.523935]  ret_from_fork+0x36e/0x5a0\\n  [    2.523937]  ? __pfx_ret_from_fork+0x10/0x10\\n  [    2.523938]  ? __switch_to+0x572/0xdd0\\n  [    2.523943]  ? __pfx_kthread+0x10/0x10\\n  [    2.523944]  ret_from_fork_asm+0x1a/0x30\\n  [    2.523947]  \u003c/TASK\u003e\\n  [    2.523948]\\n  [    2.531253] Allocated by task 48:\\n  [    2.531399]  kasan_save_stack+0x33/0x60\\n  [    2.531570]  kasan_save_track+0x14/0x30\\n  [    2.531737]  __kasan_kmalloc+0x8f/0xa0\\n  [    2.531905]  __kmalloc_cache_noprof+0x158/0x370\\n  [    2.532100]  smc_llc_enqueue+0x72/0x560\\n  [    2.532268]  smc_wr_rx_tasklet_fn+0x474/0xa80\\n  [    2.532491]  tasklet_action_common+0x20f/0x8a0\\n  [    2.532714]  handle_softirqs+0x18e/0x590\\n  [    2.532886]  do_softirq+0x3b/0x60\\n  [    2.533036]  __local_bh_enable_ip+0x61/0x70\\n  [    2.533221]  __alloc_skb+0x732/0x890\\n  [    2.533384]  rxe_init_packet+0x16b/0x4f0\\n  [    2.533567]  prepare_ack_packet+0xb8/0x830\\n  [    2.533760]  rxe_receiver+0x495/0x96e0\\n  [    2.533933]  do_work+0x144/0x470\\n  [    2\\n---truncated---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/smc/smc_llc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"27ef6a9981fe74191849966a6d5e0400a4008ab8\",\"lessThan\":\"c52a998a223e7e84333306996edec096178d1e95\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"27ef6a9981fe74191849966a6d5e0400a4008ab8\",\"lessThan\":\"adef84cc85d449ac28d2b4b4c49cf19619c56e27\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"27ef6a9981fe74191849966a6d5e0400a4008ab8\",\"lessThan\":\"a42a459ef0e54cb0c4b3e43e21cb0e658e664f64\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/smc/smc_llc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/a42a459ef0e54cb0c4b3e43e21cb0e658e664f64\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/adef84cc85d449ac28d2b4b4c49cf19619c56e27\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c52a998a223e7e84333306996edec096178d1e95\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T19:18:50+00:00",
      "cve": "CVE-2026-80981",
      "id": "CVE-2026-80981",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "185",
      "product_status:known_not_affected": "91",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80981.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T01:04:49Z",
      "cve": "CVE-2026-80981",
      "id": "CVE-2026-80981",
      "initial_release_date": "2026-09-12T16:36:18Z",
      "product_status:known_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80981",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80981.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.