CVE-2026-23450 (GCVE-0-2026-23450)
Vulnerability from cvelistv5 – Published: 2026-04-03 15:15 – Updated: 2026-04-27 14:02
VLAI?
Title
net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
Summary
In the Linux kernel, the following vulnerability has been resolved:
net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
Syzkaller reported a panic in smc_tcp_syn_recv_sock() [1].
smc_tcp_syn_recv_sock() is called in the TCP receive path
(softirq) via icsk_af_ops->syn_recv_sock on the clcsock (TCP
listening socket). It reads sk_user_data to get the smc_sock
pointer. However, when the SMC listen socket is being closed
concurrently, smc_close_active() sets clcsock->sk_user_data
to NULL under sk_callback_lock, and then the smc_sock itself
can be freed via sock_put() in smc_release().
This leads to two issues:
1) NULL pointer dereference: sk_user_data is NULL when
accessed.
2) Use-after-free: sk_user_data is read as non-NULL, but the
smc_sock is freed before its fields (e.g., queued_smc_hs,
ori_af_ops) are accessed.
The race window looks like this (the syzkaller crash [1]
triggers via the SYN cookie path: tcp_get_cookie_sock() ->
smc_tcp_syn_recv_sock(), but the normal tcp_check_req() path
has the same race):
CPU A (softirq) CPU B (process ctx)
tcp_v4_rcv()
TCP_NEW_SYN_RECV:
sk = req->rsk_listener
sock_hold(sk)
/* No lock on listener */
smc_close_active():
write_lock_bh(cb_lock)
sk_user_data = NULL
write_unlock_bh(cb_lock)
...
smc_clcsock_release()
sock_put(smc->sk) x2
-> smc_sock freed!
tcp_check_req()
smc_tcp_syn_recv_sock():
smc = user_data(sk)
-> NULL or dangling
smc->queued_smc_hs
-> crash!
Note that the clcsock and smc_sock are two independent objects
with separate refcounts. TCP stack holds a reference on the
clcsock, which keeps it alive, but this does NOT prevent the
smc_sock from being freed.
Fix this by using RCU and refcount_inc_not_zero() to safely
access smc_sock. Since smc_tcp_syn_recv_sock() is called in
the TCP three-way handshake path, taking read_lock_bh on
sk_callback_lock is too heavy and would not survive a SYN
flood attack. Using rcu_read_lock() is much more lightweight.
- Set SOCK_RCU_FREE on the SMC listen socket so that
smc_sock freeing is deferred until after the RCU grace
period. This guarantees the memory is still valid when
accessed inside rcu_read_lock().
- Use rcu_read_lock() to protect reading sk_user_data.
- Use refcount_inc_not_zero(&smc->sk.sk_refcnt) to pin the
smc_sock. If the refcount has already reached zero (close
path completed), it returns false and we bail out safely.
Note: smc_hs_congested() has a similar lockless read of
sk_user_data without rcu_read_lock(), but it only checks for
NULL and accesses the global smc_hs_wq, never dereferencing
any smc_sock field, so it is not affected.
Reproducer was verified with mdelay injection and smc_run,
the issue no longer occurs with this patch applied.
[1] https://syzkaller.appspot.com/bug?extid=827ae2bfb3a3529333e9
Severity ?
9.8 (Critical)
Assigner
References
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Linux | Linux |
Affected:
ebfee3e153f67c8b38eb94a7062ee94aa6f92708 , < f315277856caeafcd996c2611afc085ca2d53275
(git)
Affected: 8270d9c21041470f58348248b9d9dcf3bf79592e , < 1e4f873879e075bbd4eb1c644d6933303ac5eba4 (git) Affected: 8270d9c21041470f58348248b9d9dcf3bf79592e , < f00fc26c8a06442b225a350fe000c0a11483e6a3 (git) Affected: 8270d9c21041470f58348248b9d9dcf3bf79592e , < cadf3da46c15523fba90d80c9955f536ee3b4023 (git) Affected: 8270d9c21041470f58348248b9d9dcf3bf79592e , < fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2 (git) Affected: 8270d9c21041470f58348248b9d9dcf3bf79592e , < 1fab5ece76fb42a761178dcd0ebcbf578377b0dd (git) Affected: 8270d9c21041470f58348248b9d9dcf3bf79592e , < 6d5e4538364b9ceb1ac2941a4deb86650afb3538 (git) |
|||||||
|
|||||||||
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/smc/af_smc.c",
"net/smc/smc.h",
"net/smc/smc_close.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "f315277856caeafcd996c2611afc085ca2d53275",
"status": "affected",
"version": "ebfee3e153f67c8b38eb94a7062ee94aa6f92708",
"versionType": "git"
},
{
"lessThan": "1e4f873879e075bbd4eb1c644d6933303ac5eba4",
"status": "affected",
"version": "8270d9c21041470f58348248b9d9dcf3bf79592e",
"versionType": "git"
},
{
"lessThan": "f00fc26c8a06442b225a350fe000c0a11483e6a3",
"status": "affected",
"version": "8270d9c21041470f58348248b9d9dcf3bf79592e",
"versionType": "git"
},
{
"lessThan": "cadf3da46c15523fba90d80c9955f536ee3b4023",
"status": "affected",
"version": "8270d9c21041470f58348248b9d9dcf3bf79592e",
"versionType": "git"
},
{
"lessThan": "fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2",
"status": "affected",
"version": "8270d9c21041470f58348248b9d9dcf3bf79592e",
"versionType": "git"
},
{
"lessThan": "1fab5ece76fb42a761178dcd0ebcbf578377b0dd",
"status": "affected",
"version": "8270d9c21041470f58348248b9d9dcf3bf79592e",
"versionType": "git"
},
{
"lessThan": "6d5e4538364b9ceb1ac2941a4deb86650afb3538",
"status": "affected",
"version": "8270d9c21041470f58348248b9d9dcf3bf79592e",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/smc/af_smc.c",
"net/smc/smc.h",
"net/smc/smc_close.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "5.18"
},
{
"lessThan": "5.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.203",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.167",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.130",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.78",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.20",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.19.*",
"status": "unaffected",
"version": "6.19.10",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.0",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.203",
"versionStartIncluding": "5.15.174",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.167",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.130",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.78",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.20",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.19.10",
"versionStartIncluding": "5.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0",
"versionStartIncluding": "5.18",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()\n\nSyzkaller reported a panic in smc_tcp_syn_recv_sock() [1].\n\nsmc_tcp_syn_recv_sock() is called in the TCP receive path\n(softirq) via icsk_af_ops-\u003esyn_recv_sock on the clcsock (TCP\nlistening socket). It reads sk_user_data to get the smc_sock\npointer. However, when the SMC listen socket is being closed\nconcurrently, smc_close_active() sets clcsock-\u003esk_user_data\nto NULL under sk_callback_lock, and then the smc_sock itself\ncan be freed via sock_put() in smc_release().\n\nThis leads to two issues:\n\n1) NULL pointer dereference: sk_user_data is NULL when\n accessed.\n2) Use-after-free: sk_user_data is read as non-NULL, but the\n smc_sock is freed before its fields (e.g., queued_smc_hs,\n ori_af_ops) are accessed.\n\nThe race window looks like this (the syzkaller crash [1]\ntriggers via the SYN cookie path: tcp_get_cookie_sock() -\u003e\nsmc_tcp_syn_recv_sock(), but the normal tcp_check_req() path\nhas the same race):\n\n CPU A (softirq) CPU B (process ctx)\n\n tcp_v4_rcv()\n TCP_NEW_SYN_RECV:\n sk = req-\u003ersk_listener\n sock_hold(sk)\n /* No lock on listener */\n smc_close_active():\n write_lock_bh(cb_lock)\n sk_user_data = NULL\n write_unlock_bh(cb_lock)\n ...\n smc_clcsock_release()\n sock_put(smc-\u003esk) x2\n -\u003e smc_sock freed!\n tcp_check_req()\n smc_tcp_syn_recv_sock():\n smc = user_data(sk)\n -\u003e NULL or dangling\n smc-\u003equeued_smc_hs\n -\u003e crash!\n\nNote that the clcsock and smc_sock are two independent objects\nwith separate refcounts. TCP stack holds a reference on the\nclcsock, which keeps it alive, but this does NOT prevent the\nsmc_sock from being freed.\n\nFix this by using RCU and refcount_inc_not_zero() to safely\naccess smc_sock. Since smc_tcp_syn_recv_sock() is called in\nthe TCP three-way handshake path, taking read_lock_bh on\nsk_callback_lock is too heavy and would not survive a SYN\nflood attack. Using rcu_read_lock() is much more lightweight.\n\n- Set SOCK_RCU_FREE on the SMC listen socket so that\n smc_sock freeing is deferred until after the RCU grace\n period. This guarantees the memory is still valid when\n accessed inside rcu_read_lock().\n- Use rcu_read_lock() to protect reading sk_user_data.\n- Use refcount_inc_not_zero(\u0026smc-\u003esk.sk_refcnt) to pin the\n smc_sock. If the refcount has already reached zero (close\n path completed), it returns false and we bail out safely.\n\nNote: smc_hs_congested() has a similar lockless read of\nsk_user_data without rcu_read_lock(), but it only checks for\nNULL and accesses the global smc_hs_wq, never dereferencing\nany smc_sock field, so it is not affected.\n\nReproducer was verified with mdelay injection and smc_run,\nthe issue no longer occurs with this patch applied.\n\n[1] https://syzkaller.appspot.com/bug?extid=827ae2bfb3a3529333e9"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-04-27T14:02:29.638Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275"
},
{
"url": "https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4"
},
{
"url": "https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3"
},
{
"url": "https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023"
},
{
"url": "https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2"
},
{
"url": "https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd"
},
{
"url": "https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538"
}
],
"title": "net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-23450",
"datePublished": "2026-04-03T15:15:33.144Z",
"dateReserved": "2026-01-13T15:37:46.020Z",
"dateUpdated": "2026-04-27T14:02:29.638Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-23450",
"date": "2026-05-09",
"epss": "0.00078",
"percentile": "0.23084"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-23450\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-04-03T16:16:31.243\",\"lastModified\":\"2026-04-27T14:16:33.563\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()\\n\\nSyzkaller reported a panic in smc_tcp_syn_recv_sock() [1].\\n\\nsmc_tcp_syn_recv_sock() is called in the TCP receive path\\n(softirq) via icsk_af_ops-\u003esyn_recv_sock on the clcsock (TCP\\nlistening socket). It reads sk_user_data to get the smc_sock\\npointer. However, when the SMC listen socket is being closed\\nconcurrently, smc_close_active() sets clcsock-\u003esk_user_data\\nto NULL under sk_callback_lock, and then the smc_sock itself\\ncan be freed via sock_put() in smc_release().\\n\\nThis leads to two issues:\\n\\n1) NULL pointer dereference: sk_user_data is NULL when\\n accessed.\\n2) Use-after-free: sk_user_data is read as non-NULL, but the\\n smc_sock is freed before its fields (e.g., queued_smc_hs,\\n ori_af_ops) are accessed.\\n\\nThe race window looks like this (the syzkaller crash [1]\\ntriggers via the SYN cookie path: tcp_get_cookie_sock() -\u003e\\nsmc_tcp_syn_recv_sock(), but the normal tcp_check_req() path\\nhas the same race):\\n\\n CPU A (softirq) CPU B (process ctx)\\n\\n tcp_v4_rcv()\\n TCP_NEW_SYN_RECV:\\n sk = req-\u003ersk_listener\\n sock_hold(sk)\\n /* No lock on listener */\\n smc_close_active():\\n write_lock_bh(cb_lock)\\n sk_user_data = NULL\\n write_unlock_bh(cb_lock)\\n ...\\n smc_clcsock_release()\\n sock_put(smc-\u003esk) x2\\n -\u003e smc_sock freed!\\n tcp_check_req()\\n smc_tcp_syn_recv_sock():\\n smc = user_data(sk)\\n -\u003e NULL or dangling\\n smc-\u003equeued_smc_hs\\n -\u003e crash!\\n\\nNote that the clcsock and smc_sock are two independent objects\\nwith separate refcounts. TCP stack holds a reference on the\\nclcsock, which keeps it alive, but this does NOT prevent the\\nsmc_sock from being freed.\\n\\nFix this by using RCU and refcount_inc_not_zero() to safely\\naccess smc_sock. Since smc_tcp_syn_recv_sock() is called in\\nthe TCP three-way handshake path, taking read_lock_bh on\\nsk_callback_lock is too heavy and would not survive a SYN\\nflood attack. Using rcu_read_lock() is much more lightweight.\\n\\n- Set SOCK_RCU_FREE on the SMC listen socket so that\\n smc_sock freeing is deferred until after the RCU grace\\n period. This guarantees the memory is still valid when\\n accessed inside rcu_read_lock().\\n- Use rcu_read_lock() to protect reading sk_user_data.\\n- Use refcount_inc_not_zero(\u0026smc-\u003esk.sk_refcnt) to pin the\\n smc_sock. If the refcount has already reached zero (close\\n path completed), it returns false and we bail out safely.\\n\\nNote: smc_hs_congested() has a similar lockless read of\\nsk_user_data without rcu_read_lock(), but it only checks for\\nNULL and accesses the global smc_hs_wq, never dereferencing\\nany smc_sock field, so it is not affected.\\n\\nReproducer was verified with mdelay injection and smc_run,\\nthe issue no longer occurs with this patch applied.\\n\\n[1] https://syzkaller.appspot.com/bug?extid=827ae2bfb3a3529333e9\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…