Executive brief
A vulnerability in the Linux kernel's Shared Memory Communications (SMC) component can cause a system crash. When specific diagnostic tracing is enabled by an administrator, an unprivileged user can trigger a 'null pointer dereference' by initiating a network connection. This results in a kernel panic (Blue Screen equivalent), leading to a complete loss of system availability.
Technical details
A NULL pointer dereference exists in the smc_msg_event tracepoint class within net/smc/smc_tracepoint.h. The tracepoint unconditionally dereferences 'smc->conn.lnk->ibname', but the 'lnk' pointer is NULL for SMC-D (Direct) connections, as it is only populated for SMC-R (Remote) connections. While enabling the tracepoint requires root privileges, the vulnerability can be triggered by an unprivileged user through standard socket operations (AF_SMC) that negotiate an SMC-D connection. This results in a general protection fault and kernel oops. The fix introduces a check to ensure the link pointer is valid before dereferencing.
Affected products
- Linux Linux Kernel aff3083f10bf to 7bf563badd37
Timeline
- 2026-05-10: disclosed: Vulnerability reported/authored by Xiang Mei
- 2026-06-01: patched: Commits merged into various stable branches
- 2026-06-24: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/561cf66fa9b6c86dfe4e687d2d1aeaaa6739917f
- https://git.kernel.org/stable/c/68200112534bb2acd1d7117dc2d5c124868d866d
- https://git.kernel.org/stable/c/720c76b930c52cd58f50eb6b10569d03dccc7959
- https://git.kernel.org/stable/c/7bf563badd37cb796df5477d2b78bb64148a1268
- https://git.kernel.org/stable/c/b706d6d76a2a2793fe5ad0fbc2a75b6a460094ef
- https://git.kernel.org/stable/c/d2ea0b8aef8746e147602eac87ca8538f4bc7e66