CVE-2026-64541 (GCVE-0-2026-64541)

Vulnerability from cvelistv5 – Published: 2026-07-27 20:10 – Updated: 2026-07-27 20:10
VLAI
Title
net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket
Summary
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket smc_cdc_rx_handler() looks up the connection by token under the link group's conns_lock, drops the lock, and then dereferences conn and the smc_sock derived from it, ending in sock_hold(&smc->sk) inside smc_cdc_msg_recv(). No reference is held across the lock release. The only reference pinning the socket while the connection is discoverable in the link group is taken in smc_lgr_register_conn() (sock_hold) and dropped in __smc_lgr_unregister_conn() (sock_put), both under conns_lock. Once the handler drops conns_lock, a concurrent close() -> smc_release() -> smc_conn_free() -> smc_lgr_unregister_conn() can drop that reference and free the smc_sock, so the handler's later sock_hold() runs on freed memory: WARNING: lib/refcount.c:25 at refcount_warn_saturate Workqueue: rxe_wq do_work refcount_warn_saturate (lib/refcount.c:25) smc_cdc_msg_recv (net/smc/smc_cdc.c:430) smc_cdc_rx_handler (net/smc/smc_cdc.c:502) smc_wr_rx_tasklet_fn (net/smc/smc_wr.c:445) tasklet_action_common (kernel/softirq.c:938) handle_softirqs (kernel/softirq.c:622) Kernel panic - not syncing: panic_on_warn set Only SMC-R is affected. The SMC-D receive tasklet is stopped by tasklet_kill(&conn->rx_tsklet) in smc_conn_free() before the connection is unregistered, so it cannot run concurrently with the free. Take the socket reference while still holding conns_lock, so the registration reference can no longer be the last one, and drop it once the handler is done.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: d7b0e37c1ac152905b18a5b9506179091a35b0b6 , < 8de4f665d0febfb92803dece377791a563fc7041 (git)
Affected: d7b0e37c1ac152905b18a5b9506179091a35b0b6 , < 8145b432136285e01091815b48ceb2dae261f262 (git)
Affected: d7b0e37c1ac152905b18a5b9506179091a35b0b6 , < 1951bffbc6493ec34cff3956b29d4bc6606904a6 (git)
Affected: d7b0e37c1ac152905b18a5b9506179091a35b0b6 , < 647b19e5cc145a2f1f685ae8ff3805a17356888c (git)
Affected: d7b0e37c1ac152905b18a5b9506179091a35b0b6 , < 472e9d7c0d5b03be3ff91ff941f57da822b031bc (git)
Affected: d7b0e37c1ac152905b18a5b9506179091a35b0b6 , < 3bfb96d9bc6a7ed0b99c7db329cc2e22a28d84bb (git)
Affected: d7b0e37c1ac152905b18a5b9506179091a35b0b6 , < ce5aa8084329351086894aa34d77e40301d5bd3d (git)
Affected: d7b0e37c1ac152905b18a5b9506179091a35b0b6 , < 9d160b35cc34a2ba8229d07651468a7848325135 (git)
Create a notification for this product.
Linux Linux Affected: 4.18
Unaffected: 0 , < 4.18 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2-rc3 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/smc/smc_cdc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8de4f665d0febfb92803dece377791a563fc7041",
              "status": "affected",
              "version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
              "versionType": "git"
            },
            {
              "lessThan": "8145b432136285e01091815b48ceb2dae261f262",
              "status": "affected",
              "version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
              "versionType": "git"
            },
            {
              "lessThan": "1951bffbc6493ec34cff3956b29d4bc6606904a6",
              "status": "affected",
              "version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
              "versionType": "git"
            },
            {
              "lessThan": "647b19e5cc145a2f1f685ae8ff3805a17356888c",
              "status": "affected",
              "version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
              "versionType": "git"
            },
            {
              "lessThan": "472e9d7c0d5b03be3ff91ff941f57da822b031bc",
              "status": "affected",
              "version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
              "versionType": "git"
            },
            {
              "lessThan": "3bfb96d9bc6a7ed0b99c7db329cc2e22a28d84bb",
              "status": "affected",
              "version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
              "versionType": "git"
            },
            {
              "lessThan": "ce5aa8084329351086894aa34d77e40301d5bd3d",
              "status": "affected",
              "version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
              "versionType": "git"
            },
            {
              "lessThan": "9d160b35cc34a2ba8229d07651468a7848325135",
              "status": "affected",
              "version": "d7b0e37c1ac152905b18a5b9506179091a35b0b6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/smc/smc_cdc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "lessThan": "4.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc3",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket\n\nsmc_cdc_rx_handler() looks up the connection by token under the link\ngroup\u0027s conns_lock, drops the lock, and then dereferences conn and the\nsmc_sock derived from it, ending in sock_hold(\u0026smc-\u003esk) inside\nsmc_cdc_msg_recv(). No reference is held across the lock release.\n\nThe only reference pinning the socket while the connection is\ndiscoverable in the link group is taken in smc_lgr_register_conn()\n(sock_hold) and dropped in __smc_lgr_unregister_conn() (sock_put), both\nunder conns_lock. Once the handler drops conns_lock, a concurrent\nclose() -\u003e smc_release() -\u003e smc_conn_free() -\u003e smc_lgr_unregister_conn()\ncan drop that reference and free the smc_sock, so the handler\u0027s later\nsock_hold() runs on freed memory:\n\n  WARNING: lib/refcount.c:25 at refcount_warn_saturate\n  Workqueue: rxe_wq do_work\n   refcount_warn_saturate (lib/refcount.c:25)\n   smc_cdc_msg_recv (net/smc/smc_cdc.c:430)\n   smc_cdc_rx_handler (net/smc/smc_cdc.c:502)\n   smc_wr_rx_tasklet_fn (net/smc/smc_wr.c:445)\n   tasklet_action_common (kernel/softirq.c:938)\n   handle_softirqs (kernel/softirq.c:622)\n  Kernel panic - not syncing: panic_on_warn set\n\nOnly SMC-R is affected. The SMC-D receive tasklet is stopped by\ntasklet_kill(\u0026conn-\u003erx_tsklet) in smc_conn_free() before the connection\nis unregistered, so it cannot run concurrently with the free.\n\nTake the socket reference while still holding conns_lock, so the\nregistration reference can no longer be the last one, and drop it once\nthe handler is done."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-27T20:10:34.439Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/8de4f665d0febfb92803dece377791a563fc7041"
        },
        {
          "url": "https://git.kernel.org/stable/c/8145b432136285e01091815b48ceb2dae261f262"
        },
        {
          "url": "https://git.kernel.org/stable/c/1951bffbc6493ec34cff3956b29d4bc6606904a6"
        },
        {
          "url": "https://git.kernel.org/stable/c/647b19e5cc145a2f1f685ae8ff3805a17356888c"
        },
        {
          "url": "https://git.kernel.org/stable/c/472e9d7c0d5b03be3ff91ff941f57da822b031bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/3bfb96d9bc6a7ed0b99c7db329cc2e22a28d84bb"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce5aa8084329351086894aa34d77e40301d5bd3d"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d160b35cc34a2ba8229d07651468a7848325135"
        }
      ],
      "title": "net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64541",
    "datePublished": "2026-07-27T20:10:34.439Z",
    "dateReserved": "2026-07-19T15:36:31.795Z",
    "dateUpdated": "2026-07-27T20:10:34.439Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64541\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-27T21:17:06.570\",\"lastModified\":\"2026-07-27T21:17:06.570\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket\\n\\nsmc_cdc_rx_handler() looks up the connection by token under the link\\ngroup\u0027s conns_lock, drops the lock, and then dereferences conn and the\\nsmc_sock derived from it, ending in sock_hold(\u0026smc-\u003esk) inside\\nsmc_cdc_msg_recv(). No reference is held across the lock release.\\n\\nThe only reference pinning the socket while the connection is\\ndiscoverable in the link group is taken in smc_lgr_register_conn()\\n(sock_hold) and dropped in __smc_lgr_unregister_conn() (sock_put), both\\nunder conns_lock. Once the handler drops conns_lock, a concurrent\\nclose() -\u003e smc_release() -\u003e smc_conn_free() -\u003e smc_lgr_unregister_conn()\\ncan drop that reference and free the smc_sock, so the handler\u0027s later\\nsock_hold() runs on freed memory:\\n\\n  WARNING: lib/refcount.c:25 at refcount_warn_saturate\\n  Workqueue: rxe_wq do_work\\n   refcount_warn_saturate (lib/refcount.c:25)\\n   smc_cdc_msg_recv (net/smc/smc_cdc.c:430)\\n   smc_cdc_rx_handler (net/smc/smc_cdc.c:502)\\n   smc_wr_rx_tasklet_fn (net/smc/smc_wr.c:445)\\n   tasklet_action_common (kernel/softirq.c:938)\\n   handle_softirqs (kernel/softirq.c:622)\\n  Kernel panic - not syncing: panic_on_warn set\\n\\nOnly SMC-R is affected. The SMC-D receive tasklet is stopped by\\ntasklet_kill(\u0026conn-\u003erx_tsklet) in smc_conn_free() before the connection\\nis unregistered, so it cannot run concurrently with the free.\\n\\nTake the socket reference while still holding conns_lock, so the\\nregistration reference can no longer be the last one, and drop it once\\nthe handler is done.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/smc/smc_cdc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d7b0e37c1ac152905b18a5b9506179091a35b0b6\",\"lessThan\":\"8de4f665d0febfb92803dece377791a563fc7041\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d7b0e37c1ac152905b18a5b9506179091a35b0b6\",\"lessThan\":\"8145b432136285e01091815b48ceb2dae261f262\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d7b0e37c1ac152905b18a5b9506179091a35b0b6\",\"lessThan\":\"1951bffbc6493ec34cff3956b29d4bc6606904a6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d7b0e37c1ac152905b18a5b9506179091a35b0b6\",\"lessThan\":\"647b19e5cc145a2f1f685ae8ff3805a17356888c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d7b0e37c1ac152905b18a5b9506179091a35b0b6\",\"lessThan\":\"472e9d7c0d5b03be3ff91ff941f57da822b031bc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d7b0e37c1ac152905b18a5b9506179091a35b0b6\",\"lessThan\":\"3bfb96d9bc6a7ed0b99c7db329cc2e22a28d84bb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d7b0e37c1ac152905b18a5b9506179091a35b0b6\",\"lessThan\":\"ce5aa8084329351086894aa34d77e40301d5bd3d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d7b0e37c1ac152905b18a5b9506179091a35b0b6\",\"lessThan\":\"9d160b35cc34a2ba8229d07651468a7848325135\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/smc/smc_cdc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.261\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.212\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.178\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.145\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.97\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.40\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2-rc3\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1951bffbc6493ec34cff3956b29d4bc6606904a6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3bfb96d9bc6a7ed0b99c7db329cc2e22a28d84bb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/472e9d7c0d5b03be3ff91ff941f57da822b031bc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/647b19e5cc145a2f1f685ae8ff3805a17356888c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8145b432136285e01091815b48ceb2dae261f262\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8de4f665d0febfb92803dece377791a563fc7041\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9d160b35cc34a2ba8229d07651468a7848325135\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ce5aa8084329351086894aa34d77e40301d5bd3d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.