Executive brief
The Linux kernel's SMC (Shared Memory Communications) protocol handler contains a memory leak in the link-layer control (LLC) flow management. When transitioning between certain link addition states, the kernel fails to free previously queued message entries before overwriting them, causing kernel memory to leak. While the leaked memory is modest per occurrence, repeated triggering could degrade system stability on systems using SMC for high-speed networking.
Technical details
A memory leak exists in net/smc/smc_llc.c in the smc_llc_event_handler() function. When the LLC flow transitions from SMC_LLC_FLOW_REQ_ADD_LINK to SMC_LLC_FLOW_ADD_LINK upon receipt of an ADD_LINK message, the code calls smc_llc_flow_qentry_set() to store a new queue entry without first freeing any previously stashed entry. If a CONFIRM_LINK or ADD_LINK_CONT message arrived during the REQ_ADD_LINK state, it would have been stashed into flow->qentry but never consumed (since no worker thread is yet waiting). The subsequent ADD_LINK overwrites this pointer, leaking the kmalloc'd object. The fix adds a call to smc_llc_flow_qentry_del() before smc_llc_flow_qentry_set() to safely free any stashed entry. The vulnerability is reachable on systems with active SMC connections receiving specific message sequences, though no authentication bypass or direct privilege escalation is involved.
Affected products
- Linux Linux kernel Affected versions include at least Linux 5.12 through 6.x (introduced in commit b4ba4652b3f8)
Timeline
- 2026-08-18: disclosed
- 2026-08-20: patched