Executive brief
A vulnerability in the Linux kernel's Shared Memory Communications (SMC) networking component could lead to system instability. The issue occurs when the system incorrectly resets internal tracking tables while they are already in use, potentially causing memory corruption. This could lead to system crashes or unpredictable behavior during network operations.
Technical details
A vulnerability in net/smc/af_smc.c arises because INIT_HLIST_HEAD() is called for smc_v4_hashinfo.ht and smc_v6_hashinfo.ht after the protocol and sockets have already been registered and initialized via smc_nl_init(). If hash entries are created and used between these calls, the re-initialization resets the head pointers, leading to the loss of existing entries and potential linked-list corruption. An attacker with local access could potentially trigger this behavior to cause a kernel panic or memory corruption. The fix involves removing the redundant initialization in smc_init() and using static initialization with HLIST_HEAD_INIT instead.
Affected products
- Linux Linux 4.11 to 5.10.259, 5.15.210, 6.1.176, 6.6.x, 6.9.x
Timeline
- 2026-05-21: patched: Initial patch proposed by Alexandra Winter
- 2026-07-19: disclosed: CVE-2026-64005 published
References
- https://git.kernel.org/stable/c/0cc9d0ac22d02f1ba1884de5d6de9eaf8b45d82d
- https://git.kernel.org/stable/c/2006605006e5a4a11d93e1ebdbbe95764d24276f
- https://git.kernel.org/stable/c/55cba6b883b41e5922c00ba9d4e3262131f46f1b
- https://git.kernel.org/stable/c/5ec939367e700722ffbb1b7cacccbb1a3cf0ebd1
- https://git.kernel.org/stable/c/64c96e497d5ada0b90e99bf58f893aa2b73dcfbc
- https://git.kernel.org/stable/c/9e4389b0038781f19f97895186ed941ff8ac1678
- https://git.kernel.org/stable/c/cdc79c05cc375f68ae87b0c74fdaac1a5c93155a