Executive brief
The Linux kernel's SMC (SOCKS over RDMA) networking protocol has a race condition in connection teardown where a receive tasklet can access freed memory buffers. When connections are terminated, the kernel may re-arm the receive handler after freeing the send buffer, causing the handler to dereference a memory region that has already been freed. This can lead to system crashes or potential code execution on systems using SMC for high-speed network communication.
Technical details
The vulnerability is a use-after-free race condition in the SMC connection teardown path (net/smc/smc_core.c). The root cause is that smc_conn_free() only calls smc_ism_unset_conn() when the link group is still attached to a device, but smc_lgr_terminate_sched() unlinks groups immediately and defers connection killing to a work item. A connection freed during this window retains slots in the device's smcd->conn[] array, allowing smcd_handle_irq() to re-arm the receive tasklet after tasklet_kill() returns. On the DMB-nocopy path, the send buffer is freed immediately after the drain, causing the re-armed tasklet to dereference freed memory. The fix unconditionally calls smc_ism_unset_conn() before draining the tasklet and nullifies conn->sndbuf_desc before freeing the buffer. The attack vector is local/adjacent on systems using SMC protocol, requiring no special privileges. Patches are available in the mainline kernel and stable branches.
Affected products
- Linux Linux kernel multiple versions prior to fix commit 36cdf5d48ca191dcd71c28cadbe0981b1d25318d
Timeline
- 2026-09-11: disclosed: CVE-2026-80979 published
- 2026-08-13: patched: Fix commit 36cdf5d48ca191dcd71c28cadbe0981b1d25318d merged to mainline
- 2026-09-07: patched: Backported to stable kernel branches