Linux kernel SMC: use-after-free when a splice reader releases RMB pages during concurrent socket close

Impact

smc_rx_splice() hands remote-memory-buffer pages to a pipe and pins the smc_sock, but not the connection. smc_rx_pipe_buf_release() tested sk_state before taking the socket lock, so a concurrent close could run smc_conn_free() in the gap; smc_rx_update_cons() then dereferenced conn->rmb_desc and walked conn->lgr after the receive buffer had been returned to the link-group pool, and on the is_reg_err path the descriptor was freed outright. That is a use-after-free with kernel heap objects in the RDMA receive path. SMC-R runs over RoCE and InfiniBand, which is exactly the fabric GPU nodes use for collectives and storage, so this is worth attention on any host where SMC is loaded and in use - a crash takes down every job on the node, and the corruption primitive is a local privilege-escalation candidate. Hosts that never load the smc module are not exposed.

Who can reach it

Local unprivileged process that can open an SMC socket and race splice() reads against a close - no network position and no special capability beyond reaching the SMC socket family, which requires the smc module to be loaded.

What to do

Apply the stable-kernel update with the referenced commits and reboot; on GPU hosts that means drain, reboot, and readmit. Where SMC is not deliberately in use, blacklisting or unloading the smc module removes the exposure without a reboot and is the cheap interim step. The record gives stable commits, not a fixed release number.

References

Related entries

• Windows Update Stack: link following lets a local user escalate to SYSTEMCVE-2026-81963 · Windows Update Stack (link following during update servicing)High
• Windows ALPC: heap overflow gives a local user privilege escalation to SYSTEMCVE-2026-85880 · Windows ALPC (Advanced Local Procedure Call)High
• Linux kernel sunrpc: use-gss-proxy proc entry published before its mutex is initializedCVE-2026-89540 · Linux kernel sunrpc/auth_rpcgss (use-gss-proxy procfs entry, gssp_lock init ordering)High
• Linux kernel nfsd: use-after-free reading NFSv4 compound ops from the rpc_status netlink dumpCVE-2026-89690 · Linux kernel nfsd (nfsd4_release_compoundargs / rpc_status netlink dump)High
• Linux kernel mm/pagewalk: stale ACTION_AGAIN causes duplicate walk callbacks and an out-of-bounds write via mincore()CVE-2026-89754 · Linux kernel mm/pagewalk (walk_pmd_range stale walk->action)High
• Linux kernel mm/migrate_device: stale swapcache mapping after folio_free_swap() corrupts folio refcountsCVE-2026-89755 · Linux kernel mm/migrate_device (__migrate_device_pages stale swapcache mapping)High