Executive brief
A vulnerability in the Linux kernel's Shared Memory Communications (SMC) protocol can cause a system crash or kernel panic. This occurs when specific system calls (tee and splice) are used to duplicate network data buffers, leading to memory corruption. An attacker with local access could exploit this to disrupt system availability or potentially gain elevated privileges.
Technical details
A double-free vulnerability exists in net/smc/smc_rx.c within the Linux kernel. The smc_rx_splice() function allocates an smc_spd_priv structure per pipe_buffer, but the associated pipe_buf_operations used generic_pipe_buf_get, which fails to increment the reference count for the private data when tee(2) duplicates the buffer. Consequently, when both the original and cloned buffers are released, smc_rx_pipe_buf_release() is called twice on the same object, resulting in a slab-use-after-free and subsequent NULL pointer dereference. This can be triggered by a local user using the tee(2) or splice(2) system calls on an SMC socket. The fix involves implementing a custom .get callback that disallows cloning of these specific buffers.
Affected products
- Linux Linux Kernel 9014db202cb7
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
- Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.6
Timeline
- 2026-03-18: other: Patch authored
- 2026-04-22: disclosed: CVE published
References
- https://git.kernel.org/stable/c/24dd586bb4cbba1889a50abe74143817a095c1c9
- https://git.kernel.org/stable/c/3cc76380fea749280c026f410af56a28aaac388a
- https://git.kernel.org/stable/c/54c87a730157868543ebdfa0ecb21b4590ed23a5
- https://git.kernel.org/stable/c/7bcb974c771c863e8588cea0012ac204443a7126
- https://git.kernel.org/stable/c/7e8916f46c2f48607f907fd401590093753a6bc5
- https://git.kernel.org/stable/c/81acbd345d405994875d419d43b319fee0b9ad62
- https://git.kernel.org/stable/c/98ba5cb274768146e25ffbfde47753652c1c20d3