Executive brief
The Linux kernel's SMC (Shared Memory Communications) networking subsystem contains a memory leak in the flow control logic. When processing late-arriving duplicate network messages, a pending queue entry can be overwritten without being freed. This causes a gradual buildup of unreleased memory on systems using SMC, potentially leading to memory exhaustion and denial of service over extended periods.
Technical details
The vulnerability is a resource leak in net/smc/smc_llc.c within the smc_llc_flow_stop() function. When flow->qentry is non-NULL, a blind memset overwrites the pointer without freeing the underlying kmalloc allocation. The issue occurs when late-arriving duplicate CONFIRM_LINK or ADD_LINK_CONT messages set flow->qentry after legitimate message consumption but before flow completion. The qentry is then lost when memset zeros the struct. The fix calls smc_llc_flow_qentry_del() inside the lock before memset to properly clean up pending entries. This is a local issue affecting systems using SMC sockets; no network attack vector is required.
Affected products
- Linux Linux kernel likely all versions with SMC support (introduced in Linux 4.16 or earlier)
Timeline
- 2026-09-17: disclosed: Published in NVD
- 2026-08-18: patched: Upstream patch committed by Mahanta Jambigi
- 2026-09-14: patched: Integrated into stable kernel trees