Executive brief
A design flaw in the Linux kernel's networking component could allow a local attacker to cause system instability or crashes. The issue stems from how the system handles specialized network connections (SMC) by incorrectly modifying internal data structures that are supposed to remain unchanged. This could lead to memory errors that disrupt operations or potentially allow for further exploitation.
Technical details
The vulnerability exists in the net/smc component of the Linux kernel. The implementation of TCP ULP support for SMC attempted to convert an active TCP socket into an SMC socket by modifying 'struct file', dentry, and inode structures in-place. This violates core VFS invariants which assume these structures are immutable for an open file. This architectural flaw creates a risk of use-after-free (UAF) conditions. Because the design was considered fundamentally broken and cleaner alternatives like BPF or LD_PRELOAD exist, the feature was entirely removed (reverted) from the kernel to resolve the issue.
Affected products
- Linux Linux Kernel Introduced in d7cd421da9da; fixed in 6c505d95c69e and df31a6b0a305
Timeline
- 2026-01-28: disclosed: Patch submitted to revert the broken feature
- 2026-06-09: advisory: CVE-2026-46330 published by NVD