The Linux kernel’s SMC networking subsystem contains a race condition that can trigger a use‑after‑free of a socket during link group termination. The flaw occurs when smc_lgr_terminate releases the conns_lock before taking a reference to the socket, allowing a concurrent close to unregister and free that socket. An attacker who can execute code locally on the system and orchestrate this race can corrupt kernel memory, as demonstrated by KASAN’s slab‑use‑after‑free reports, potentially enabling a denial of service or escalation to higher privileges.

All Linux kernel releases that include the SMC module before the patch are vulnerable. The vulnerability is present in the current SMC implementation regardless of specific kernel version; any kernel using this SMC code that has not applied the update is susceptible.

The CVSS base score of 9.8 emphasizes critical severity, while the EPSS score of less than 1% suggests a low likelihood of real‑world exploitation. The vulnerability is not cataloged in CISA’s KEV, indicating no known deployments of an active exploit. Nonetheless, the exploit requires precise timing of a race between link group termination and a concurrent connection close, which reduces its practicality for attackers but does not eliminate the risk of a local denial of service or kernel compromise.