Executive brief
The Linux kernel's SMC (Shared Memory Communications) networking module contains a reference counting bug in its splice implementation. An attacker or buggy application using splice() with SMC sockets can trigger premature memory deallocation, leading to use-after-free conditions that may crash the system or enable privilege escalation on affected hosts.
Technical details
The vulnerability is a refcount imbalance in smc_rx_splice() where page and socket references are not taken before passing entries to splice_to_pipe(). The splice_to_pipe() function may immediately release unqueued entries via smc_rx_spd_release(), causing mismatched refcount increments and decrements. In VM-backed RMB paths, multi-page splices pair a single sock_hold() with multiple sock_put() calls, while page refcounts can underflow. The fix takes page and socket references before splice_to_pipe() and releases them in smc_rx_spd_release() only for entries that are never queued. This requires no authentication and is triggered by normal splice() syscalls on SMC sockets.
Affected products
- Linux Linux kernel 5.15 and later (introduced in commit 9014db202cb7)
Timeline
- 2026-08-22: disclosed
- 2026-08-19: patched