Linux kernel (net/smc): An inbound SYN handled in softirq reads the smc_sock out of the listening TCP socket's

Impact

An inbound SYN handled in softirq reads the smc_sock out of the listening TCP socket's sk_user_data while a concurrent close is clearing it and freeing that smc_sock, so the packet path dereferences NULL or a dangling pointer. A remote host that keeps sending connection attempts to an SMC listener that is closing gets an unauthenticated use-after-free in the network receive path - the strongest primitive in this shard.

Who can reach it

Remote, pre-authentication, packet-driven: the race is in smc_tcp_syn_recv_sock, called from tcp_v4_rcv / tcp_check_req and from the SYN-cookie path, so nothing more than SYN traffic to an SMC-capable listening port is required. No tenant privilege and no RDMA access is needed on the attacker side; the victim only needs an SMC listener, and the smc module autoloads from any unprivileged socket(AF_SMC, ...).

What to do

Update to 5.15.203 or later on that branch, or any kernel carrying the fix commits. Interim: stop exposing SMC listeners to untrusted networks and tenants, and blacklist the smc module (install smc /bin/false) on nodes not using SMC.

References