CVE-2026-80982

net/smc: fix use-after-free in smc_rx_pipe_buf_release()

Published Sep 11, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

net/smc: fix use-after-free in smc_rx_pipe_buf_release()

smc_rx_splice() hands RMB pages to a pipe and takes a socket reference
per entry so the smc_sock stays alive until the reader finishes. The
connection does not: a concurrent close runs smc_conn_free(), which
releases the receive buffer back to the link group pool.

smc_rx_pipe_buf_release() tests sk_state before taking the socket lock.
The state can change between the test and the lock, and
smc_rx_update_cons() then dereferences conn->rmb_desc and walks
conn->lgr, which smc_conn_free() has already released. On the
is_reg_err path smcr_buf_unuse() frees the descriptor outright, so
this is a use-after-free.

Take the socket lock first and test conn->freed instead.
smc_conn_free() sets that flag before releasing anything, and every
caller holds the socket lock. The two paths exclude each other: either
the pipe release runs first with everything valid, or it sees the flag
and skips the update.

Analysis

Technical impact

The issue is a race condition in the Linux kernel's SMC networking module. When a socket is closed concurrently with the release of a pipe buffer, the driver can dereference memory that has already been freed. This use‑after‑free (CWE‑825) can corrupt kernel state and potentially allow a local attacker to execute arbitrary code with kernel privileges.

Affected Systems

Any Linux kernel build that includes the net/smc driver andc vulnerable. The vulnerability affects the kernel as a whole and is not tied to a specific hardware device; it is triggered by operations on the SMC network socket.

Risk and Exploitability

The CVSS score of 7.8 indicates high severity. The EPSS score of less than 1 % suggests a low probability of real‑world exploitation at the time of analysis. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require an attacker with local access to the affected kernel and the ability to manipulate the SMC socket state while data is being piped, which is not a typical remote attack scenario.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`9014db202cb764b8e14c53e7bacc81f9a1a2ba7f`	affected	< dadd97c8296b23aa816e91ed70041820ae087baa
`9014db202cb764b8e14c53e7bacc81f9a1a2ba7f`	affected	< df441f3efbb50eb0f120b8de4bf441c31fb0551d
`9014db202cb764b8e14c53e7bacc81f9a1a2ba7f`	affected	< 6a644a7340df978785f3109d1e0726a982ce2c6f
`9014db202cb764b8e14c53e7bacc81f9a1a2ba7f`	affected	< 0761e49aa78c2f1362511054c6e9670653858837
`9014db202cb764b8e14c53e7bacc81f9a1a2ba7f`	affected	< 0926f59ca0f94120895b92180c636a48d0ed3a6d
`9014db202cb764b8e14c53e7bacc81f9a1a2ba7f`	affected	< c924884743e948e25625b7fbf3ee2a9325a204a7

Linux

affected

Version	Status	Constraints
`4.18`	affected	—
`0`	unaffected	< 4.18
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[9014db202cb764b8e14c53e7bacc81f9a1a2ba7f,6a644a7340df978785f3109d1e0726a982ce2f)`	affected	code_commit	—
`[9014db202cb764b8e14c53e7bacc81f9a1a2ba7f,0761e49aa78c2f1362511054c6e9670653858837)`	affected	code_commit	—
`[9014db202cb764b8e14c53e7bacc81f9a1a2ba7f,0926f59ca0f94120895b92180c636a48d0ed3a6d)`	affected	code_commit	—
`[9014db202cb764b8e14c53e7bacc81f9a1a2ba7f,c924884743e948e25625b7fbf3ee2a9325a204a7)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`4.18`	affected	generic	—
`[0,4.18)`	unaffected	generic	—
`[6.12.109,6.13.0)`	unaffected	generic	—
`[6.18.50,6.19.0)`	unaffected	generic	—
`[7.2.4,7.3.0)`	unaffected	generic	—
`[7.3-rc1,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the kernel version that contains the smc_rx_pipe_buf_release patch (e.g., upgrade to the latest stable release or apply the individual patch from the kernel repository).
If the SMC driver is not required, disable it in the kernel configuration or unload the module to reduce the attack surface.
For systems that cannot be upgraded immediately, apply any vendor‑supplied backported patch that incorporates this fix.

Generated by OpenCVE AI on September 21, 2026 at 02:18 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4817-1	linux-6.12 security update
Debian DLA	DLA-4841-1	linux security update
Debian DSA	DSA-6528-1	linux security update
Ubuntu USN	USN-9002-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.164% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/0761e49aa78c2f1362511054c6e9670653858837
https://git.kernel.org/stable/c/0926f59ca0f94120895b92180c636a48d0ed3a6d
https://git.kernel.org/stable/c/6a644a7340df978785f3109d1e0726a982ce2c6f
https://git.kernel.org/stable/c/c924884743e948e25625b7fbf3ee2a9325a204a7
https://git.kernel.org/stable/c/dadd97c8296b23aa816e91ed70041820ae087baa
https://git.kernel.org/stable/c/df441f3efbb50eb0f120b8de4bf441c31fb0551d
https://nvd.nist.gov/vuln/detail/CVE-2026-80982
https://www.cve.org/CVERecord?id=CVE-2026-80982

History

Oct 16, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Sep 14, 2026 12:30 PM Added references View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/dadd97c8296b23aa816e91ed70041820ae087baa https://git.kernel.org/stable/c/df441f3efbb50eb0f120b8de4bf441c31fb0551d

Sep 13, 2026 6:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sep 12, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://nvd.nist.gov/vuln/detail/CVE-2026-80982 https://www.cve.org/CVERecord?id=CVE-2026-80982
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sep 11, 2026 11:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free in smc_rx_pipe_buf_release() smc_rx_splice() hands RMB pages to a pipe and takes a socket reference per entry so the smc_sock stays alive until the reader finishes. The connection does not: a concurrent close runs smc_conn_free(), which releases the receive buffer back to the link group pool. smc_rx_pipe_buf_release() tests sk_state before taking the socket lock. The state can change between the test and the lock, and smc_rx_update_cons() then dereferences conn->rmb_desc and walks conn->lgr, which smc_conn_free() has already released. On the is_reg_err path smcr_buf_unuse() frees the descriptor outright, so this is a use-after-free. Take the socket lock first and test conn->freed instead. smc_conn_free() sets that flag before releasing anything, and every caller holds the socket lock. The two paths exclude each other: either the pipe release runs first with everything valid, or it sees the flag and skips the update.
Title		net/smc: fix use-after-free in smc_rx_pipe_buf_release()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0761e49aa78c2f1362511054c6e9670653858837 https://git.kernel.org/stable/c/0926f59ca0f94120895b92180c636a48d0ed3a6d https://git.kernel.org/stable/c/6a644a7340df978785f3109d1e0726a982ce2c6f https://git.kernel.org/stable/c/c924884743e948e25625b7fbf3ee2a9325a204a7