CVE-2026-23450 - Vulnerability Details

Description

In the Linux kernel, the following vulnerability has been resolved:

net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()

Syzkaller reported a panic in smc_tcp_syn_recv_sock() [1].

smc_tcp_syn_recv_sock() is called in the TCP receive path
(softirq) via icsk_af_ops->syn_recv_sock on the clcsock (TCP
listening socket). It reads sk_user_data to get the smc_sock
pointer. However, when the SMC listen socket is being closed
concurrently, smc_close_active() sets clcsock->sk_user_data
to NULL under sk_callback_lock, and then the smc_sock itself
can be freed via sock_put() in smc_release().

This leads to two issues:

1) NULL pointer dereference: sk_user_data is NULL when
accessed.
2) Use-after-free: sk_user_data is read as non-NULL, but the
smc_sock is freed before its fields (e.g., queued_smc_hs,
ori_af_ops) are accessed.

The race window looks like this (the syzkaller crash [1]
triggers via the SYN cookie path: tcp_get_cookie_sock() ->
smc_tcp_syn_recv_sock(), but the normal tcp_check_req() path
has the same race):

CPU A (softirq) CPU B (process ctx)

tcp_v4_rcv()
TCP_NEW_SYN_RECV:
sk = req->rsk_listener
sock_hold(sk)
/* No lock on listener */
smc_close_active():
write_lock_bh(cb_lock)
sk_user_data = NULL
write_unlock_bh(cb_lock)
...
smc_clcsock_release()
sock_put(smc->sk) x2
-> smc_sock freed!
tcp_check_req()
smc_tcp_syn_recv_sock():
smc = user_data(sk)
-> NULL or dangling
smc->queued_smc_hs
-> crash!

Note that the clcsock and smc_sock are two independent objects
with separate refcounts. TCP stack holds a reference on the
clcsock, which keeps it alive, but this does NOT prevent the
smc_sock from being freed.

Fix this by using RCU and refcount_inc_not_zero() to safely
access smc_sock. Since smc_tcp_syn_recv_sock() is called in
the TCP three-way handshake path, taking read_lock_bh on
sk_callback_lock is too heavy and would not survive a SYN
flood attack. Using rcu_read_lock() is much more lightweight.

- Set SOCK_RCU_FREE on the SMC listen socket so that
smc_sock freeing is deferred until after the RCU grace
period. This guarantees the memory is still valid when
accessed inside rcu_read_lock().
- Use rcu_read_lock() to protect reading sk_user_data.
- Use refcount_inc_not_zero(&smc->sk.sk_refcnt) to pin the
smc_sock. If the refcount has already reached zero (close
path completed), it returns false and we bail out safely.

Note: smc_hs_congested() has a similar lockless read of
sk_user_data without rcu_read_lock(), but it only checks for
NULL and accesses the global smc_hs_wq, never dereferencing
any smc_sock field, so it is not affected.

Reproducer was verified with mdelay injection and smc_run,
the issue no longer occurs with this patch applied.

[1] https://syzkaller.appspot.com/bug?extid=827ae2bfb3a3529333e9

Published: 2026-04-03

Score: 7.0 High

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel contains a race condition that can cause a NULL pointer dereference or use‑after‑free when the smc_tcp_syn_recv_sock() routine reads the SMC socket pointer while a concurrent close operation clears it. The flaw is triggered during the TCP three‑way handshake, specifically when SYN packets are processed. This can lead to a kernel panic, denial of service, or if an attacker controls the freed memory, arbitrary code execution with kernel privileges.

Affected Systems

The vulnerability affects all Linux kernel installations that include the SMC (Socket Multi‑Protocol) module and have an SMC listening socket. No specific kernel version list is provided in the source material, so the flaw applies to all kernel versions prior to the application of the described patch.

Risk and Exploitability

Severity is likely high given the potential for kernel crashes or privilege escalation, but CVSS scores are unavailable. EPSS data is not provided, and the issue is not recorded in CISA's KEV catalog. The attack vector is network‑based, requiring the injection of SYN packets toward an SMC listening socket; the race is reproducible by tools such as syzkaller, indicating that the threat is exploitable in practice though no real‑world exploitation reports are cited.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`8270d9c21041470f58348248b9d9dcf3bf79592e`	affected	< 1e4f873879e075bbd4eb1c644d6933303ac5eba4
`8270d9c21041470f58348248b9d9dcf3bf79592e`	affected	< f00fc26c8a06442b225a350fe000c0a11483e6a3
`8270d9c21041470f58348248b9d9dcf3bf79592e`	affected	< cadf3da46c15523fba90d80c9955f536ee3b4023
`8270d9c21041470f58348248b9d9dcf3bf79592e`	affected	< fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
`8270d9c21041470f58348248b9d9dcf3bf79592e`	affected	< 1fab5ece76fb42a761178dcd0ebcbf578377b0dd
`8270d9c21041470f58348248b9d9dcf3bf79592e`	affected	< 6d5e4538364b9ceb1ac2941a4deb86650afb3538
`ebfee3e153f67c8b38eb94a7062ee94aa6f92708`	affected	—

Linux

affected

Version	Status	Constraints
`5.18`	affected	—
`0`	unaffected	< 5.18
`6.1.167`	unaffected	≤ 6.1.*
`6.6.130`	unaffected	≤ 6.6.*
`6.12.78`	unaffected	≤ 6.12.*
`6.18.20`	unaffected	≤ 6.18.*
`6.19.10`	unaffected	≤ 6.19.*
`7.0-rc5`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[8270d9c21041470f58348248b9d9dcf3bf79592e,1e4f873879e075bbd4eb1c644d6933303ac5eba4)`	affected	code_commit	—
`[8270d9c21041470f58348248b9d9dcf3bf79592e,f00fc26c8a06442b225a350fe000c0a11483e6a3)`	affected	code_commit	—
`[8270d9c21041470f58348248b9d9dcf3bf79592e,cadf3da46c15523fba90d80c9955f536ee3b4023)`	affected	code_commit	—
`[8270d9c21041470f58348248b9d9dcf3bf79592e,fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2)`	affected	code_commit	—
`[8270d9c21041470f58348248b9d9dcf3bf79592e,1fab5ece76fb42a761178dcd0ebcbf578377b0dd)`	affected	code_commit	—
`[8270d9c21041470f58348248b9d9dcf3bf79592e,6d5e4538364b9ceb1ac2941a4deb86650afb3538)`	affected	code_commit	—
`ebfee3e153f67c8b38eb94a7062ee94aa6f92708`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.18`	affected	semver	—
`[0,5.18)`	unaffected	semver	—
`[6.1.167,6.2.0)`	unaffected	semver	—
`[6.6.130,6.7.0)`	unaffected	semver	—
`[6.12.78,6.13.0)`	unaffected	semver	—
`[6.18.20,6.19.0)`	unaffected	semver	—
`[6.19.10,6.20.0)`	unaffected	semver	—
`[7.0-rc5,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the smc_tcp_syn_recv_sock() patch.
If an upgrade is delayed, disable or restrict the SMC service so that no listening sockets accept external traffic.
Monitor network traffic for abnormal SYN patterns that may indicate an attempt to trigger the race condition.
Apply the patch manually from the kernel source tree if the distribution does not yet provide an updated package.

Generated by OpenCVE AI on April 3, 2026 at 18:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
https://lore.kernel.org/linux-cve-announce/2026040316-CVE-2026-23450-2437@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-23450
https://www.cve.org/CVERecord?id=CVE-2026-23450

History

Sat, 04 Apr 2026 01:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026040316-CVE-2026-23450-2437@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-23450 https://www.cve.org/CVERecord?id=CVE-2026-23450
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Important`

Fri, 03 Apr 2026 21:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416 CWE-476

Fri, 03 Apr 2026 16:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() Syzkaller reported a panic in smc_tcp_syn_recv_sock() [1]. smc_tcp_syn_recv_sock() is called in the TCP receive path (softirq) via icsk_af_ops->syn_recv_sock on the clcsock (TCP listening socket). It reads sk_user_data to get the smc_sock pointer. However, when the SMC listen socket is being closed concurrently, smc_close_active() sets clcsock->sk_user_data to NULL under sk_callback_lock, and then the smc_sock itself can be freed via sock_put() in smc_release(). This leads to two issues: 1) NULL pointer dereference: sk_user_data is NULL when accessed. 2) Use-after-free: sk_user_data is read as non-NULL, but the smc_sock is freed before its fields (e.g., queued_smc_hs, ori_af_ops) are accessed. The race window looks like this (the syzkaller crash [1] triggers via the SYN cookie path: tcp_get_cookie_sock() -> smc_tcp_syn_recv_sock(), but the normal tcp_check_req() path has the same race): CPU A (softirq) CPU B (process ctx) tcp_v4_rcv() TCP_NEW_SYN_RECV: sk = req->rsk_listener sock_hold(sk) /* No lock on listener */ smc_close_active(): write_lock_bh(cb_lock) sk_user_data = NULL write_unlock_bh(cb_lock) ... smc_clcsock_release() sock_put(smc->sk) x2 -> smc_sock freed! tcp_check_req() smc_tcp_syn_recv_sock(): smc = user_data(sk) -> NULL or dangling smc->queued_smc_hs -> crash! Note that the clcsock and smc_sock are two independent objects with separate refcounts. TCP stack holds a reference on the clcsock, which keeps it alive, but this does NOT prevent the smc_sock from being freed. Fix this by using RCU and refcount_inc_not_zero() to safely access smc_sock. Since smc_tcp_syn_recv_sock() is called in the TCP three-way handshake path, taking read_lock_bh on sk_callback_lock is too heavy and would not survive a SYN flood attack. Using rcu_read_lock() is much more lightweight. - Set SOCK_RCU_FREE on the SMC listen socket so that smc_sock freeing is deferred until after the RCU grace period. This guarantees the memory is still valid when accessed inside rcu_read_lock(). - Use rcu_read_lock() to protect reading sk_user_data. - Use refcount_inc_not_zero(&smc->sk.sk_refcnt) to pin the smc_sock. If the refcount has already reached zero (close path completed), it returns false and we bail out safely. Note: smc_hs_congested() has a similar lockless read of sk_user_data without rcu_read_lock(), but it only checks for NULL and accesses the global smc_hs_wq, never dereferencing any smc_sock field, so it is not affected. Reproducer was verified with mdelay injection and smc_run, the issue no longer occurs with this patch applied. [1] https://syzkaller.appspot.com/bug?extid=827ae2bfb3a3529333e9
Title		net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4 https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538 https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023 https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3 https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-04-03T15:15:33.144Z

Updated: 2026-04-03T15:15:33.144Z

Reserved: 2026-01-13T15:37:46.020Z

Link: CVE-2026-23450

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-04-03T16:16:31.243

Modified: 2026-04-03T16:16:31.243

Link: CVE-2026-23450

Redhat

Severity : Important

Publid Date: 2026-04-03T00:00:00Z

Links: CVE-2026-23450 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-03T21:16:02Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object