Linux kernel net/smc: unlocked bitfield sharing corrupts SMC connection state flags

Impact

Three single-bit flags in struct smc_connection shared one byte, so every store was a read-modify-write of its neighbours, and they were written from contexts with no common lock - out_of_sync from the receive tasklet, killed from process context under lock_sock(), with the receive path taking only bh_lock_sock(). Concurrent stores can therefore lose or resurrect a flag, leaving connection teardown state inconsistent. The fix gives each flag its own byte, growing the struct by two bytes. This only matters on nodes that actually use SMC (AF_SMC / SMC-R over RoCE); that is uncommon outside IBM-influenced stacks, and a GPU fleet running ordinary TCP or native RDMA verbs is not exposed. The NVD 9.8 network-remote score is an automated placeholder and is not supported by the commit message, which describes a local data race, not remote code execution.

Who can reach it

Requires SMC sockets to be in use on the host. Exposure is to peers on an existing SMC connection and to local workloads that open AF_SMC sockets; there is no path for a tenant that cannot reach the SMC stack. If the smc module is not loaded, the node is not affected.

What to do

Pick up the fix in your stable kernel (three stable commits are linked) and reboot the node on the normal kernel-update cycle. If SMC is unused, blacklisting or not loading the smc module removes the exposure without a reboot, which is the cheaper answer for most fleets. Do not schedule an emergency drain on the strength of the NVD score.

References

Related entries

• Linux kernel SMC-R: use-after-free of the LLC queue entry when adding a second RDMA linkCVE-2026-80981 · Linux kernel net/smc (smc_llc_srv_add_link LLC qentry lifetime)Critical
• Linux NFSD: use-after-free in the inter-server copy mount expiry walkCVE-2026-89712 · Linux kernel NFSD (inter-server copy, nfsd4_ssc_expire_umount)Critical
• Linux kernel qla2xxx: double completion in async IOCB timeout frees a live stack frameCVE-2026-89847 · Linux kernel qla2xxx (async IOCB timeout completion handling)Critical
• Linux kernel qla2xxx: NVMe LS reject path advances the request ring without the qpair lockCVE-2026-89857 · Linux kernel qla2xxx (NVMe-FC LS reject, request ring locking)Critical
• Linux kernel nvmet-tcp: over-long PDU writes past the 128-byte receive bufferCVE-2026-89969 · Linux kernel nvmet-tcp (NVMe-over-TCP target PDU receive)Critical
• Linux kernel nvmet-auth: use-after-free when auth timeout work races SQ teardownCVE-2026-89970 · Linux kernel nvmet-auth (NVMe target SQ teardown)Critical