Linux kernel (net/ipv4): A child socket created from an inbound handshake is inserted into the TCP hash table before

Impact

A child socket created from an inbound handshake is inserted into the TCP hash table before its IPv6 private-data pointer is fixed up, so other CPUs can find and use a socket that still points at the listener's ipv6_pinfo. A remote peer that opens connections to any listener - including the SMC/MPTCP paths that share this code - drives other CPUs into type-confused socket state.

Who can reach it

Remote and pre-authentication: the window is inside tcp_v4_syn_recv_sock / tcp_v6_syn_recv_sock during the three-way handshake, so ordinary connection traffic to any TCP listener on the node is enough, with no credentials. This is core TCP rather than an optional module - it surfaced in this seam because net/smc/af_smc.c is one of the callers - so every node is exposed regardless of whether SMC or RDMA is in use.

What to do

Boot a kernel carrying the fix commits (moves the IPv6 child fixup into tcp_v6_mapped_child_init, before ehash insertion). There is no meaningful interim control - the path is core TCP accept handling; patch and reboot.

References