GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80982 (GCVE-0-2026-80982)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:42 – Updated: 2026-09-14 11:59
VLAI
Title
net/smc: fix use-after-free in smc_rx_pipe_buf_release()
Summary
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free in smc_rx_pipe_buf_release() smc_rx_splice() hands RMB pages to a pipe and takes a socket reference per entry so the smc_sock stays alive until the reader finishes. The connection does not: a concurrent close runs smc_conn_free(), which releases the receive buffer back to the link group pool. smc_rx_pipe_buf_release() tests sk_state before taking the socket lock. The state can change between the test and the lock, and smc_rx_update_cons() then dereferences conn->rmb_desc and walks conn->lgr, which smc_conn_free() has already released. On the is_reg_err path smcr_buf_unuse() frees the descriptor outright, so this is a use-after-free. Take the socket lock first and test conn->freed instead. smc_conn_free() sets that flag before releasing anything, and every caller holds the socket lock. The two paths exclude each other: either the pipe release runs first with everything valid, or it sees the flag and skips the update.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f , < dadd97c8296b23aa816e91ed70041820ae087baa (git)
Affected: 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f , < df441f3efbb50eb0f120b8de4bf441c31fb0551d (git)
Affected: 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f , < 6a644a7340df978785f3109d1e0726a982ce2c6f (git)
Affected: 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f , < 0761e49aa78c2f1362511054c6e9670653858837 (git)
Affected: 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f , < 0926f59ca0f94120895b92180c636a48d0ed3a6d (git)
Affected: 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f , < c924884743e948e25625b7fbf3ee2a9325a204a7 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.18
Unaffected: 0 , < 4.18 (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/smc/smc_rx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "dadd97c8296b23aa816e91ed70041820ae087baa",
              "status": "affected",
              "version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f",
              "versionType": "git"
            },
            {
              "lessThan": "df441f3efbb50eb0f120b8de4bf441c31fb0551d",
              "status": "affected",
              "version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f",
              "versionType": "git"
            },
            {
              "lessThan": "6a644a7340df978785f3109d1e0726a982ce2c6f",
              "status": "affected",
              "version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f",
              "versionType": "git"
            },
            {
              "lessThan": "0761e49aa78c2f1362511054c6e9670653858837",
              "status": "affected",
              "version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f",
              "versionType": "git"
            },
            {
              "lessThan": "0926f59ca0f94120895b92180c636a48d0ed3a6d",
              "status": "affected",
              "version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f",
              "versionType": "git"
            },
            {
              "lessThan": "c924884743e948e25625b7fbf3ee2a9325a204a7",
              "status": "affected",
              "version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/smc/smc_rx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "lessThan": "4.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix use-after-free in smc_rx_pipe_buf_release()\n\nsmc_rx_splice() hands RMB pages to a pipe and takes a socket reference\nper entry so the smc_sock stays alive until the reader finishes. The\nconnection does not: a concurrent close runs smc_conn_free(), which\nreleases the receive buffer back to the link group pool.\n\nsmc_rx_pipe_buf_release() tests sk_state before taking the socket lock.\nThe state can change between the test and the lock, and\nsmc_rx_update_cons() then dereferences conn-\u003ermb_desc and walks\nconn-\u003elgr, which smc_conn_free() has already released. On the\nis_reg_err path smcr_buf_unuse() frees the descriptor outright, so\nthis is a use-after-free.\n\nTake the socket lock first and test conn-\u003efreed instead.\nsmc_conn_free() sets that flag before releasing anything, and every\ncaller holds the socket lock. The two paths exclude each other: either\nthe pipe release runs first with everything valid, or it sees the flag\nand skips the update."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is in smc_rx_pipe_buf_release(), a pipe_buf_ops.release callback reached only via local splice() on an AF_SMC socket (syscall -\u003e sock_splice_read -\u003e smc_splice_read -\u003e smc_rx_recvmsg -\u003e smc_rx_splice). A remote SMC peer can supply RMB data or close the connection, but cannot invoke the splice pipe-buffer release path by itself.\nAC:L - The attacker controls both sides of the TOCTOU: one thread splices SMC Rx data into a pipe and then reads or closes it (unlocked sk_state check, then lock_sock), while another closes the socket so smc_conn_free() drops rmb_desc/lgr in that window. The race is fully attacker-driven and retryable.\nPR:L - socket(AF_SMC) or IPPROTO_SMC, connect/listen (loopback-ism, ISM, or RoCE), splice(2), and close(2) have no capability checks and are available to an unprivileged local user. User-namespace admin rights are not required.\nUI:N - A single unprivileged process can act as both SMC endpoints on loopback or a local fabric, splice received data into a pipe, and race close() against pipe-buffer release. No victim user action is required.\nS:U - The corruption is confined to kernel objects (smc_buf_desc, smc_link_group) in the same kernel security authority. This is standard kernel memory corruption, not a VM, IOMMU, or sandbox boundary escape.\nC:H - smc_rx_update_cons() dereferences conn-\u003ermb_desc and walks conn-\u003elgr after smc_conn_free()/smcr_buf_unuse() released them; on the is_reg_err path smc_buf_free() frees the descriptor outright. Per kernel CVSS guidance, this UAF of heap objects enables arbitrary kernel-memory disclosure.\nI:H - The same UAF writes consumer cursors and may call smc_tx_consumer_update() -\u003e smc_cdc_get_slot_and_msg_send() or queue_delayed_work on conn-\u003elgr-\u003etx_wq after the link group is freed, enabling heap reuse, arbitrary write, and control-flow hijack.\nA:H - Dereferencing the freed rmb_desc or link group produces a kernel oops or panic. Use-after-free on this path crashes the host even when not fully exploited, and the attacker can repeat the race at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T11:59:25.672Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/dadd97c8296b23aa816e91ed70041820ae087baa"
        },
        {
          "url": "https://git.kernel.org/stable/c/df441f3efbb50eb0f120b8de4bf441c31fb0551d"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a644a7340df978785f3109d1e0726a982ce2c6f"
        },
        {
          "url": "https://git.kernel.org/stable/c/0761e49aa78c2f1362511054c6e9670653858837"
        },
        {
          "url": "https://git.kernel.org/stable/c/0926f59ca0f94120895b92180c636a48d0ed3a6d"
        },
        {
          "url": "https://git.kernel.org/stable/c/c924884743e948e25625b7fbf3ee2a9325a204a7"
        }
      ],
      "title": "net/smc: fix use-after-free in smc_rx_pipe_buf_release()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80982",
    "datePublished": "2026-09-11T19:42:42.243Z",
    "dateReserved": "2026-08-26T14:34:25.811Z",
    "dateUpdated": "2026-09-14T11:59:25.672Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80982",
      "date": "2026-09-17",
      "epss": "0.00159",
      "percentile": "0.05509"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-14T14:53:57.000Z",
      "cve": "CVE-2026-80982",
      "id": "msrc_CVE-2026-80982",
      "initial_release_date": "2026-09-13T01:07:23.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net/smc: fix use-after-free in smc_rx_pipe_buf_release()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-80982.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/smc/smc_rx.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "dadd97c8296b23aa816e91ed70041820ae087baa",
                    "status": "affected",
                    "version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "df441f3efbb50eb0f120b8de4bf441c31fb0551d",
                    "status": "affected",
                    "version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6a644a7340df978785f3109d1e0726a982ce2c6f",
                    "status": "affected",
                    "version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0761e49aa78c2f1362511054c6e9670653858837",
                    "status": "affected",
                    "version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "0926f59ca0f94120895b92180c636a48d0ed3a6d",
                    "status": "affected",
                    "version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c924884743e948e25625b7fbf3ee2a9325a204a7",
                    "status": "affected",
                    "version": "9014db202cb764b8e14c53e7bacc81f9a1a2ba7f",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/smc/smc_rx.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.18"
                  },
                  {
                    "lessThan": "4.18",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.188",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.109",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.50",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix use-after-free in smc_rx_pipe_buf_release()\n\nsmc_rx_splice() hands RMB pages to a pipe and takes a socket reference\nper entry so the smc_sock stays alive until the reader finishes. The\nconnection does not: a concurrent close runs smc_conn_free(), which\nreleases the receive buffer back to the link group pool.\n\nsmc_rx_pipe_buf_release() tests sk_state before taking the socket lock.\nThe state can change between the test and the lock, and\nsmc_rx_update_cons() then dereferences conn-\u003ermb_desc and walks\nconn-\u003elgr, which smc_conn_free() has already released. On the\nis_reg_err path smcr_buf_unuse() frees the descriptor outright, so\nthis is a use-after-free.\n\nTake the socket lock first and test conn-\u003efreed instead.\nsmc_conn_free() sets that flag before releasing anything, and every\ncaller holds the socket lock. The two paths exclude each other: either\nthe pipe release runs first with everything valid, or it sees the flag\nand skips the update."
          }
        ],
        "id": "CVE-2026-80982",
        "lastModified": "2026-09-14T13:18:52.947",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-11T20:19:04.667",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0761e49aa78c2f1362511054c6e9670653858837"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0926f59ca0f94120895b92180c636a48d0ed3a6d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/6a644a7340df978785f3109d1e0726a982ce2c6f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c924884743e948e25625b7fbf3ee2a9325a204a7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/dadd97c8296b23aa816e91ed70041820ae087baa"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/df441f3efbb50eb0f120b8de4bf441c31fb0551d"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T19:24:23+00:00",
      "cve": "CVE-2026-80982",
      "id": "CVE-2026-80982",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "234",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/smc: fix use-after-free in smc_rx_pipe_buf_release()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80982.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:04:47Z",
      "cve": "CVE-2026-80982",
      "id": "CVE-2026-80982",
      "initial_release_date": "2026-09-12T16:36:16Z",
      "product_status:known_affected": "347",
      "product_status:known_not_affected": "6",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80982",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80982.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.