Linux kernel (net/smc): The SMC listen worker keeps touching the SMC socket after smc_listen_out() has handed it off

Impact

The SMC listen worker keeps touching the SMC socket after smc_listen_out() has handed it off and it may already be released, giving a use-after-free on the server side of connection setup. An unauthenticated peer that connects and disconnects at the right moment corrupts host kernel memory from a kworker context.

Who can reach it

Remote and pre-authentication: the fault is inside smc_listen_work, the handshake worker for inbound SMC connections, so any fabric or IP peer that can reach an SMC-capable listening socket drives it. The victim only needs the smc module loaded, which happens on the first unprivileged socket(AF_SMC, ...) anywhere on the node.

What to do

Boot a kernel carrying the fix commits. Interim: do not expose SMC-capable listeners to untrusted tenants or peers, and blacklist the smc module (install smc /bin/false) on nodes that do not use SMC-R.

References

Related entries

• Linux kernel (net/smc): An inbound SYN handled in softirq reads the smc_sock out of the listening TCP socket'sCVE-2026-23450 · Linux kernel (net/smc)Critical
• Linux kernel (net/smc): Link-group termination drops conns_lock after finding a connection but before taking a socketCVE-2026-74493 · Linux kernel (net/smc)Critical
• Linux kernel (net/smc): The IB port-up handler walks the global link-group list without holding its lock, so a fabricCVE-2023-54318 · Linux kernel (net/smc)High
• Linux kernel (net/smc): The CLC prefix-match check on the listen path dereferences the destination cache entry'sCVE-2025-40168 · Linux kernel (net/smc)High
• Linux kernel (net/smc): The CDC send-completion handler takes a lock inside an smc_sock that close() has already freedCVE-2021-46925 · Linux kernel (net/smc)High
• Linux kernel (net/smc): An unprivileged tenant that opens an AF_SMC socket, registers it with epoll, and lets theCVE-2022-48721 · Linux kernel (net/smc)High