Executive brief
The Linux kernel's SMC (Shared Memory Communications) networking subsystem contains a use-after-free vulnerability in TCP socket handling. When an SMC socket is closed, its underlying kernel TCP socket may not be fully cleaned up before being freed, allowing TCP timer callbacks to access freed memory. An attacker with local access to the system could exploit this to cause a kernel crash or potentially execute arbitrary code.
Technical details
The vulnerability exists in the SMC socket creation and cleanup path. When __smc_create() creates a kernel TCP socket, it is intended to be freed by smc_clcsock_release() during socket closure. However, if the kernel socket's TCP state is not TCP_CLOSE at cleanup time, the TCP timers are not stopped via inet_csk_destroy_sock(). These timers can fire asynchronously after the socket is freed, causing tcp_write_timer_handler() to read from freed memory (KASAN detects slab-use-after-free). The fix involves holding a reference count for the network namespace to ensure timers complete before final cleanup, similar to MPTCP subflow handling. The vulnerability requires local system access to trigger via socket syscalls and affects Linux kernel versions prior to the fix.
Affected products
- Linux Linux kernel prior to CVE-2023-53781 fix
Timeline
- 2025-12-09: disclosed
- 2023: patched: CVE-2023-53781 resolved in kernel with SMC use-after-free fix