Executive brief
A memory leak in the Linux kernel's SMC (Shared Memory Communications) networking protocol implementation causes socket reference counts to not be properly released. When network link failover occurs and certain error conditions are hit, the kernel fails to decrement a socket counter, preventing the socket from being destroyed and causing its buffers and network namespace resources to remain allocated indefinitely.
Technical details
This is a reference counting bug (resource leak) in the net/smc/smc_core.c file within the smc_switch_conns() function. The function calls sock_hold() to increment a socket reference but the early error exit path (via the err_out label) fails to call the matching sock_put() to decrement it. The leak is triggered when smc_cdc_get_free_slot() fails due to target link going down or connection being killed during SMC link failover. This causes leaked sockets to accumulate with their send/receive buffers staying allocated and network namespace references preventing namespace teardown. The fix restructures the code so sock_put() is called in all code paths. No CVSS score was assigned; this is classified as informational severity.
Affected products
- Linux Linux kernel multiple versions from 2.6.11 through 6.x (prior to fix commit 719296c4aa8)
Timeline
- 2026-09-11: disclosed: Published on NVD
- 2026-08-24: patched: Fix committed upstream (commit 719296c4aa8213d4ac8002e77d5956d436bc98d0)
- 2026-09-14: other: Patch included in stable kernel release