Executive brief
The Linux kernel's SMC (Shared Memory Communications) networking component contains a data race condition in connection state flags that are modified without proper synchronization. Attackers with network access could potentially trigger a crash or memory corruption by exploiting concurrent access to shared connection state during socket operations.
Technical details
The vulnerability is a data race in the Linux kernel's net/smc module affecting three single-bit bitfields (killed, freed, out_of_sync) within struct smc_connection. These flags share a single byte and every write operation performs a read-modify-write cycle. The receive tasklet (smc_cdc_msg_validate) modifies out_of_sync without holding the socket lock, while the process context (smc_conn_kill) modifies killed under lock_sock(), and the receive path uses only bh_lock_sock(). This lack of common locking creates a race condition where concurrent modifications can corrupt neighboring flags. The fix allocates separate bytes for each flag, eliminating the read-modify-write conflicts. The vulnerability affects the SMC protocol implementation in the kernel networking stack and can be triggered by remote peers sending crafted CDC (Congestion Data Control) messages.
Affected products
- Linux Linux kernel multiple versions affected; patch commit db51a8658c11a82432b64999519a269c3aabb447
Timeline
- 2026-09-11: disclosed: Published on NVD
- 2026-08-20: patched: Fix committed by Hidayath Khan