Executive brief
The Linux kernel's SMC (Shared Memory Communications) protocol implementation contains a use-after-free vulnerability in the pipe buffer release handler. When a user reads data via splice() and the underlying SMC connection closes concurrently, the kernel may attempt to access memory that has already been freed, potentially allowing a local attacker to cause a denial of service or execute arbitrary code.
Technical details
This is a use-after-free vulnerability in net/smc/smc_rx.c, specifically in the smc_rx_pipe_buf_release() function. The vulnerability arises from a race condition: smc_rx_splice() passes RMB (Receive Memory Buffer) pages to a kernel pipe, but the connection can be closed concurrently via smc_conn_free(), which releases the receive buffer and link group resources. The buggy code checked socket state (sk_state) before acquiring the socket lock, allowing the state to change between the check and lock acquisition. This caused smc_rx_update_cons() to dereference freed pointers (conn->rmb_desc and conn->lgr). The fix reorders operations to acquire the socket lock first and check a conn->freed flag instead, which is set before any resource cleanup. The vulnerability requires local access and affects Linux kernel versions that support SMC with splice() support (introduced in kernel 5.7+).
Affected products
- Linux Linux kernel 5.7 and later prior to patching (affected in stable branches 5.10.y through 6.19.y, 7.0.y and later)
Timeline
- 2026-09-11: disclosed: Published to NVD
- 2026-08-20: patched: Fix committed upstream by Hidayath Khan
- 2026-09-07: patched: Fix merged to stable Linux kernel branches