Linux kernel (net/smc): An inbound SYN handled in softirq reads the smc_sock out of the listening TCP socket's

Impact

An inbound SYN handled in softirq reads the smc_sock out of the listening TCP socket's sk_user_data while a concurrent close is clearing it and freeing that smc_sock, so the packet path dereferences NULL or a dangling pointer. A remote host that keeps sending connection attempts to an SMC listener that is closing gets an unauthenticated use-after-free in the network receive path - the strongest primitive in this shard.

Who can reach it

Remote, pre-authentication, packet-driven: the race is in smc_tcp_syn_recv_sock, called from tcp_v4_rcv / tcp_check_req and from the SYN-cookie path, so nothing more than SYN traffic to an SMC-capable listening port is required. No tenant privilege and no RDMA access is needed on the attacker side; the victim only needs an SMC listener, and the smc module autoloads from any unprivileged socket(AF_SMC, ...).

What to do

Update to 5.15.203 or later on that branch, or any kernel carrying the fix commits. Interim: stop exposing SMC listeners to untrusted networks and tenants, and blacklist the smc module (install smc /bin/false) on nodes not using SMC.

References

Related entries

• Linux kernel (net/smc): Link-group termination drops conns_lock after finding a connection but before taking a socketCVE-2026-74493 · Linux kernel (net/smc)Critical
• Linux kernel (net/smc): The IB port-up handler walks the global link-group list without holding its lock, so a fabricCVE-2023-54318 · Linux kernel (net/smc)High
• Linux kernel (net/smc): The CLC prefix-match check on the listen path dereferences the destination cache entry'sCVE-2025-40168 · Linux kernel (net/smc)High
• Linux kernel (net/smc): The CDC send-completion handler takes a lock inside an smc_sock that close() has already freedCVE-2021-46925 · Linux kernel (net/smc)High
• Linux kernel (net/smc): An unprivileged tenant that opens an AF_SMC socket, registers it with epoll, and lets theCVE-2022-48721 · Linux kernel (net/smc)High
• Linux kernel (net/smc): Closing an SMC socket can leave the internal TCP kernel socket with its timers still armed andCVE-2023-53781 · Linux kernel (net/smc)High