Executive brief
The Linux kernel's SMC (Shared Memory Communications) networking implementation leaks internal TCP socket objects when socket creation fails after initialization. An unprivileged user can exploit this by attaching a BPF program to deny socket creation, causing the kernel to leak memory with each failed socket() call until system memory is exhausted, potentially causing a denial of service.
Technical details
This vulnerability is a resource leak in net/smc/smc_inet.c affecting IPPROTO_SMC sockets. During socket creation, an internal TCP socket ("clcsock") is allocated in the proto->init hook. When socket creation fails after initialization (e.g., due to a BPF_CGROUP_INET_SOCK_CREATE deny policy), the common socket cleanup code sk_common_release() only calls sk_prot->destroy if defined; the SMC proto handlers (smc_inet_prot, smc_inet6_prot) lacked this hook, and smc_destruct() returns early unless sk_state is SMC_CLOSED. The attack vector requires the ability to attach a BPF cgroup program that denies socket creation. The fix adds a .destroy hook that properly releases the clcsock via smc_clcsock_release(). Patches were released upstream with commit cec261b0b4c5c0b044165303198d10ffcdf3414c.
Affected products
- Linux Linux kernel 5.x and later (SMC support introduced in later kernels; exact range varies by distribution)
Timeline
- 2026-09-17: disclosed: CVE published on NVD
- 2026-08-24: patched: Patch authored and committed upstream (commit cec261b0b4c5c0b044165303198d10ffcdf3414c)
- 2026-09-14: other: Stable backports released by Greg Kroah-Hartman