Linux net/smc: connection freed before tasklet drain leaves a use-after-free on the SMC-D receive path

Impact

smc_conn_free() only unregisters the connection while the link group is still on the device list and never sets conn->killed, so a connection freed during the window opened by smc_lgr_terminate_sched() keeps its smcd->conn[] slot live. The device can then re-arm the receive tasklet after tasklet_kill() returned, and on the DMB-nocopy path the tasklet dereferences a send buffer that was just freed - a use-after-free in the network receive path, reachable from remote peers that can drive SMC link-group termination. SMC-D is used for high-throughput RDMA-style socket traffic between hosts, so on a fabric shared across tenants this is a kernel-memory bug driven by the other end of a connection rather than by local code.

Who can reach it

A peer able to establish SMC connections to the host and cause a link group to terminate, plus the SMC-D device driving the receive tasklet. Only hosts with SMC (s390 ISM or SMC-R over RoCE) configured and in use are affected; a node with no SMC sockets never reaches this code.

What to do

Take the stable kernel update with the fix and reboot the node. If SMC is not actually in use on the fleet - the common case outside s390 and specific RoCE deployments - keep the smc module unloaded or blacklisted, which removes the exposure without a maintenance window.

References

Related entries

• Linux kernel net/smc: oversized SMC-Rv2 LLC messages let a peer delete or install RDMA rkeysCVE-2026-80985 · Linux kernel net/smc (SMC-Rv2 LLC rkey handling)Unscored
• Linux kernel net/smc: out-of-bounds read parsing the v2 extension on every SMC-Rv2 link additionCVE-2026-80986 · Linux kernel net/smc (SMC-Rv2 add-link v2 extension parsing)Unscored
• Linux kernel io_uring/query: unclamped user size lets a local task request ~4 GiB of clear_user zeroingCVE-2026-81009 · Linux kernel io_uring (IORING_REGISTER_QUERY, copy_struct_to_user size cap)Unscored
• Linux kernel io_uring/waitid: canceled task work runs __do_wait() in the wrong task contextCVE-2026-81010 · Linux kernel io_uring waitid (task_work cancellation handling)Unscored
• Linux kernel Intel Speed Select: unvalidated ioctl indices reach MMIO offsets and NULL instancesCVE-2026-89438 · Linux kernel Intel SST driver (isst_if_common ioctl input validation)Unscored
• Linux kernel iommufd: current IOAS rwsem and reference leaked when the unwind path misses itCVE-2026-89446 · Linux kernel iommufd (IOAS rwsem and object reference left held on xa_store failure)Unscored