Executive brief
A race condition in the Linux kernel's SMC (Shared Memory Communications) networking protocol can cause a system crash when a socket is being closed while the underlying link group terminates. The SMC protocol is used for efficient inter-process communication, and affected systems will experience a denial of service when closing connections during link teardown.
Technical details
The vulnerability is a null pointer dereference (CWE-476) in the SMC-D (SMC over Direct Memory) teardown path. The root cause is a race condition: smc_close_stream_wait() calls smc_tx_prepared_sends() from within an sk_wait_event() condition that releases the socket lock, while concurrently smcd_buf_detach() clears conn->sndbuf_desc under lock_sock(). If a link group terminates while a socket waits, the send buffer descriptor can become NULL between the lock release and dereference, causing a fault during close(). The fix samples the pointer once with READ_ONCE() in both smc_tx_prepared_sends() and the SIOCOUTQ ioctl handler, returning gracefully if unset. No network reachability or authentication is required; the condition occurs during normal socket lifecycle management.
Affected products
- Linux Linux kernel 5.x through 6.x (and potentially earlier stable versions)
Timeline
- 2026-09-11: disclosed: CVE-2026-80984 published
- 2026-08-13: patched: Patch committed upstream by Jakub Kicinski
- 2026-09-14: patched: Backported to stable trees by Greg Kroah-Hartman