Executive brief
A vulnerability in the Linux kernel's Shared Memory Communications (SMC) component could allow a local user to cause a system crash or potentially execute unauthorized actions. The issue occurs when the system handles specific network data transfers, leading to a memory error known as a use-after-free. This could result in data corruption, system instability, or a complete service outage.
Technical details
The vulnerability exists in the smc_lo_register_dmb() function within net/smc/smc_loopback.c. DMB buffers were incorrectly allocated using kzalloc(), which provides memory that is not necessarily page-backed. When these buffers are subsequently passed to get_page() in smc_rx_splice(), it triggers a WARN_ON_ONCE() and fails to increment the reference count. This creates a race condition where the memory can be freed while still being accessed by splice_to_pipe(), leading to a use-after-free. The fix replaces kzalloc() with folio_alloc() to ensure the memory is properly page-backed.
Affected products
- Linux Linux 6.10 to 6.12.50, 6.16.10, 6.17-rc3
Timeline
- 2025-09-17: patched: Initial patch submitted by Sidraya Jayagond
- 2025-10-20: disclosed: CVE-2025-40012 assigned and published