Executive brief
A vulnerability was identified in the Linux kernel's Shared Memory Communications (SMC) protocol, specifically affecting SMC over RDMA (SMC-R). A race condition between network packet handling and socket closure could lead to a system crash or kernel panic. This issue impacts the stability of systems utilizing high-performance RDMA networking.
Technical details
A use-after-free (UAF) vulnerability exists in net/smc/smc_cdc.c within the Linux kernel. The function smc_cdc_rx_handler() performs a connection lookup under the link group's conns_lock but releases the lock before obtaining a reference to the associated socket. A concurrent close() operation can trigger smc_release(), freeing the socket while the handler is still processing, leading to a dereference of freed memory and a subsequent kernel panic. This issue specifically affects SMC-R; SMC-D is unaffected as its tasklets are killed before unregistration. The fix involves pinning the socket by calling sock_hold() while the conns_lock is still held.
Affected products
- Linux Linux kernel d7b0e37c1ac1 to 8de4f665d0fe, 8145b4321362, 1951bffbc649, 3bfb96d9bc6a, 472e9d7c0d5b, 647b19e5cc14, 9d160b35cc34, ce5aa8084329
Timeline
- 2026-07-27: advisory: CVE-2026-64541 published by NVD
- 2026-07-24: patched: Fixes committed to various stable kernel branches
References
- https://git.kernel.org/stable/c/1951bffbc6493ec34cff3956b29d4bc6606904a6
- https://git.kernel.org/stable/c/3bfb96d9bc6a7ed0b99c7db329cc2e22a28d84bb
- https://git.kernel.org/stable/c/472e9d7c0d5b03be3ff91ff941f57da822b031bc
- https://git.kernel.org/stable/c/647b19e5cc145a2f1f685ae8ff3805a17356888c
- https://git.kernel.org/stable/c/8145b432136285e01091815b48ceb2dae261f262
- https://git.kernel.org/stable/c/8de4f665d0febfb92803dece377791a563fc7041
- https://git.kernel.org/stable/c/9d160b35cc34a2ba8229d07651468a7848325135