Linux kernel (net/smc): Connect() on an SMC socket takes the destination device pointer out of the dst cache without a

Impact

Connect() on an SMC socket takes the destination device pointer out of the dst cache without a reference and only then grabs RTNL, so a device that goes away in that window is dereferenced after free during ISM/RoCE device selection. KASAN confirms the use-after-free read in __pnet_find_base_ndev; a tenant that races connect() against interface teardown reads and can corrupt freed kernel memory.

Who can reach it

Local and unprivileged: loop connect() on AF_SMC sockets while a netdev is being removed - trivial for a tenant that controls its own veth or has a container being torn down alongside. socket(AF_SMC, ...) requires no capability and autoloads the smc module via the net-pf-43 alias, so no /dev/infiniband access is needed to reach the pnetid lookup.

What to do

Boot a kernel carrying the fix commits (holds the device reference across smc_pnet_find_ism_resource / smc_pnet_find_roce_resource). Interim: blacklist the smc module or deny socket family 43 to tenants.

References