Executive brief
A vulnerability was identified in the Linux kernel's Shared Memory Communications (SMC) protocol. Under specific conditions during the initial connection handshake, the system could attempt to access memory that has not yet been initialized. This could lead to a system crash or instability, potentially impacting the availability of services relying on high-performance networking.
Technical details
A vulnerability in net/smc/smc_clc.c was resolved where the kernel attempted to access link-group (lgr) state before it was fully initialized. During the SMC handshake, if a CLC decline message with the 'first-contact' flag is received before the connection is associated with a link group, the function smc_clc_wait_msg() would attempt to update the link-group's sync_err state. Because the link group setup has not completed, this results in an invalid memory access. The fix adds a check to ensure smc->conn.lgr is valid before attempting to update its state. This issue is reachable via network-based handshake manipulation.
Affected products
- Linux Linux Kernel Fixed in 5a8db80f721deee8e916c2cfdee78decda02ce4f and related stable backports
Timeline
- 2026-04-22: patched: Initial patch authored
- 2026-05-27: disclosed: CVE published
References
- https://git.kernel.org/stable/c/5a8db80f721deee8e916c2cfdee78decda02ce4f
- https://git.kernel.org/stable/c/6180a296ca65b08a81914805cbc0f78da5f10a1f
- https://git.kernel.org/stable/c/83bcf9228b0501694fb2589ed1d142855a2887f2
- https://git.kernel.org/stable/c/ea0b5d0fe96356dce38f98375a57c52a04e13712
- https://git.kernel.org/stable/c/f0858e1d5624bb120b198f2a8528f97a9b0ae069