Linux kernel SMC: dst entry can be freed under smc_clc_prfx_set during connect(), a local UAF

Impact

smc_clc_prfx_set() runs during connect() on an AF_SMC socket while holding neither RCU nor RTNL, and dereferences sk_dst_get(sk)->dev, so the destination cache entry and its netdev can be freed while still in use. The upstream fix switches to __sk_dst_get() and dst_dev_rcu() under rcu_read_lock(). A use-after-free in the socket path is the standard route from unprivileged code in a container to kernel compromise on the host, which on a multi-tenant GPU node means one tenant reaching the driver, the other tenants' memory and the node itself. The honest exposure caveat: SMC-R is the RDMA sockets protocol and almost no GPU fleet actually uses it, so the risk here is the module being loadable and reachable rather than the feature being deployed. This record contains the fix commits only and no exploitability analysis.

Who can reach it

Local. Any user or container process that can create an AF_SMC socket and call connect() on it, on a kernel where the smc module is present and loadable. No authentication beyond running code on the node. Unreachable where the module is absent or blacklisted.

What to do

Move to a stable kernel carrying the fix - the record links it across five stable branches - which means draining and rebooting each node, or applying a vendor live patch if one is offered for your kernel. Where SMC is not in use, which is the normal case, blacklisting the smc module prevents it from autoloading and removes the surface without a maintenance window; do that first and schedule the reboot with your next kernel cycle.

References

Related entries

• Linux kernel (net/tls): The kTLS device-offload setup resolved the socket's netdevice outside RCU, so the net_device itCVE-2025-40149 · Linux kernel (net/tls)High
• Linux kernel BPF verifier: signed comparison accepts negative ALU instruction offsetsCVE-2025-40169 · Linux kernel BPF verifier (check_alu_op offset validation)High
• Linux kernel x86/mm: missing SMP barrier in switch_mm lets a context switch skip a required TLB flushCVE-2025-40174 · Linux kernel x86/mm switch_mm_irqs_off() (missing barrier between loaded_mm store and tlb_gen load)High
• Linux kernel crypto: skcipher request size left uninitialized, causing memory corruption and crashesCVE-2025-40182 · Linux kernel crypto skcipher (request size set from cra_reqsize)High
• Linux kernel io_uring: registered-buffer folio offset miscalculated for unaligned user pointersCVE-2025-40216 · Linux kernel io_uring/rsrc (registered buffer folio coalescing)High
• Linux kernel (virt/kvm): Unbinding a memslot from a guest_memfd was skipped once the file was already dying, so if theCVE-2025-40274 · Linux kernel (virt/kvm)High