Linux kernel SMC (struct smc_sock type confusion with inet_sock): Struct smc_sock does not embed struct inet_sock as

Impact

Struct smc_sock does not embed struct inet_sock as its first member but claims AF_INET/AF_INET6 in sk_family, so generic IPv4 socket code operates on it as if it were an inet_sock. syzbot's report shows cipso_v4_sock_setattr() freeing what it thinks is inet_opt but is actually smc_sock.clcsk_data_ready - a function pointer in the text segment. Type confusion that makes the kernel treat a function pointer as a heap pointer is a strong exploitation primitive, and it is reachable by any unprivileged process that can create an SMC socket.

Who can reach it

Local, unprivileged. Create an AF_SMC socket and drive it through generic IPv4 socket options (the reported path is CIPSO).

What to do

Kernel update correcting the socket type handling. Immediate mitigation is real here: block SMC socket creation for tenants (seccomp on the socket family, or keep the module unloaded), which removes the confusion entirely without a reboot.

References