Description
In the Linux kernel, the following vulnerability has been resolved:

net/smc: fix socket refcount leak in smc_switch_conns()

smc_switch_conns() takes a reference on the SMC socket before dropping
lgr->conns_lock, so the connection stays alive while the CDC slot is
fetched:

sock_hold(&smc->sk);
read_unlock_bh(&lgr->conns_lock);
/* pre-fetch buffer outside of send_lock, might sleep */
rc = smc_cdc_get_free_slot(conn, to_lnk, &wr_buf, NULL, &pend);
if (rc)
goto err_out;

The err_out label only drops the wr_tx link reference, so this early exit
returns without the matching sock_put(). The second error exit is not
affected, because sock_put() has already run by then.

A leaked sk_refcnt means the smc_sock is never destroyed. Its send and
receive buffers stay allocated, and for a user socket the reference held
on the network namespace is never released, so the netns can no longer be
torn down.

smc_cdc_get_free_slot() fails when the target link goes down or when the
connection has been killed while the switch is in progress. Both are
reachable during the link failover this function implements, so the leak
is triggered by the same hardware events that make smc_switch_conns() run
in the first place.

Restructure so there is a single sock_put() covering both outcomes,
instead of adding a second one to the error path.
Published: 2026-09-11
Score: 4.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Socket reference leak leading to resource exhaustion and preventing network namespace teardown
Action: Patch kernel
AI Analysis

Impact

In the Linux kernel, a flaw in the smc_switch_conns() function causes a socket reference counter to remain unreleased when an error occurs during link failover handling. The socket, its send and receive buffers, and the reference to the network namespace are never freed, creating a memory and resource leak that can grow over time. This leakage prevents the network namespace from being torn down and can lead to a low‑to‑medium denial‑of‑service by exhausting system resources.

Affected Systems

All Linux kernel builds that include the vulnerable smc module before the commit that restructures smc_switch_conns() are affected. This includes every distribution that uses a kernel before the patch was released. Users should verify that their kernel does not contain the reference‑handlingpatch implementation and upgrade to a kernel that includes the fixed reference handling.

Risk and Exploitability

The CVSS score of 4.7 indicates low severity, and the EPSS data is unavailable, suggesting low exploitation probability. The flaw is not listed in CISA KEV, implying no widespread exploitation. Exposing the leak requires privileged local access and a specific hardware scenario where a link goes down or a connection is killed during a switch; therefore remote or unprivileged exploitation is unlikely.

Generated by OpenCVE AI on September 12, 2026 at 02:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply a kernel update that contains the smc_switch_conns() fix or upgrade to a recent Linux kernel version
  • Restart network services or reboot after applying the patch to clear any lingering sockets and namespaces
  • Monitor system memory usage and socket counts after network namespace operations to detect whether sockets remain open

Generated by OpenCVE AI on September 12, 2026 at 02:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 12 Sep 2026 00:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-911
References
Metrics threat_severity

None

 cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Fri, 11 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket refcount leak in smc_switch_conns() smc_switch_conns() takes a reference on the SMC socket before dropping lgr->conns_lock, so the connection stays alive while the CDC slot is fetched: sock_hold(&smc->sk); read_unlock_bh(&lgr->conns_lock); /* pre-fetch buffer outside of send_lock, might sleep */ rc = smc_cdc_get_free_slot(conn, to_lnk, &wr_buf, NULL, &pend); if (rc) goto err_out; The err_out label only drops the wr_tx link reference, so this early exit returns without the matching sock_put(). The second error exit is not affected, because sock_put() has already run by then. A leaked sk_refcnt means the smc_sock is never destroyed. Its send and receive buffers stay allocated, and for a user socket the reference held on the network namespace is never released, so the netns can no longer be torn down. smc_cdc_get_free_slot() fails when the target link goes down or when the connection has been killed while the switch is in progress. Both are reachable during the link failover this function implements, so the leak is triggered by the same hardware events that make smc_switch_conns() run in the first place. Restructure so there is a single sock_put() covering both outcomes, instead of adding a second one to the error path.
Title net/smc: fix socket refcount leak in smc_switch_conns()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-11T19:42:42.912Z

Reserved: 2026-08-26T14:34:25.811Z

Link: CVE-2026-80983

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-11T20:19:04.787

Modified: 2026-09-11T20:19:04.787

Link: CVE-2026-80983

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:42:42Z

Links: CVE-2026-80983 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-12T02:30:06Z

Weaknesses
  • CWE-911

    Improper Update of Reference Count