Linux kernel (net/smc): Closing an SMC socket can leave the internal TCP kernel socket with its timers still armed and

Impact

Closing an SMC socket can leave the internal TCP kernel socket with its timers still armed and its netns reference already dropped, so a TCP retransmit timer later fires against freed memory. KASAN confirms a slab-use-after-free read in tcp_write_timer_handler - reached from timer softirq, so it destabilises the whole node rather than the calling tenant.

Who can reach it

Local and unprivileged: create and close AF_SMC sockets in a loop (the syzbot reproducer does exactly this). socket(AF_SMC, ...) needs no capability and autoloads the smc module through the net-pf-43 alias, so any tenant container reaches it - no RDMA device or /dev/infiniband access required, because the leaked object is the clcsock TCP socket.

What to do

Boot a kernel carrying the fix commits (takes a netns reference for SMC's internal kernel sockets). Interim: blacklist smc or deny socket family 43 in tenant seccomp profiles.

References

Related entries

• Linux kernel (net/smc): SMC-D loopback registers DMBs (the direct memory buffers a peer reads and writes) out ofCVE-2025-40012 · Linux kernel (net/smc)High
• Linux kernel (net/smc): Connect() on an SMC socket takes the destination device pointer out of the dst cache without aCVE-2025-40064 · Linux kernel (net/smc)High
• Linux kernel (net/smc): Tee(2) duplicates an SMC splice pipe buffer without duplicating the private state hanging offCVE-2026-31507 · Linux kernel (net/smc)High
• Linux kernel (net/smc): The SMC socket hashtables are re-initialised at the end of module init, after the protocol andCVE-2026-64005 · Linux kernel (net/smc)High
• Linux kernel (net/smc): On hosts using soft-RoCE, the IB device has no DMA device, and the SMC buffer-mapping pathCVE-2025-39857 · Linux kernel (net/smc)High
• Linux kernel (net/smc): Setsockopt() on an SMC socket copies the option value from user memory while holding the socketCVE-2026-53274 · Linux kernel (net/smc)Medium