Linux net/smc: use-after-free on the CLC socket in smc_getname during link-group termination

Impact

smc_getname() dereferences smc->clcsock without holding clcsock_release_lock, while link-group termination can release that CLC socket asynchronously through smc_close_active_abort(). A getsockname() call racing termination reads a freed socket (KASAN slab-use-after-free in the report) or a NULL pointer - a local attacker with an SMC socket gets a kernel use-after-free, which is the usual starting point for local privilege escalation, with a panic as the low-effort outcome. This only matters on fleets that actually use SMC-R or SMC-D; SMC-R rides RoCE, so clusters that enabled it for low-latency TCP offload over the storage or east-west fabric are the exposed ones. The fix serialises the pointer check and the getname() callback under clcsock_release_lock and returns -EBADF once the CLC socket is gone.

Who can reach it

Local unprivileged user able to create an AF_SMC socket and call getsockname() while a link group terminates (reachable after shutdown(SHUT_WR)). No remote path is described. Nodes where the smc module is not loaded or AF_SMC is blocked are not reachable at all.

What to do

Take the fixed stable kernel (five stable commits in the record) and reboot the affected nodes. If you do not use SMC, the cheap mitigation available today is to keep the module from loading (blacklist/install-false for smc) so the ioctl surface does not exist; that needs no reboot on nodes where it is not already loaded.

References

Related entries

• KVM SEV: unlocked set_page_dirty on get_user_pages_fast pages during guest memory populationCVE-2026-99177 · Linux kernel KVM SEV (sev_gmem_post_populate guest-memory population)High
• Linux kernel io_uring/waitid: repeated failed cancellations wrap the reference counter and double-complete a requestCVE-2026-99227 · Linux kernel io_uring waitid (31-bit cancel reference counter wrap)High
• Linux kernel io_uring/waitid: use-after-free when the wake handler clears ->head before owning the requestCVE-2026-99231 · Linux kernel io_uring waitid (use-after-free via ->head cleared before ownership)High
• Linux kernel sched_ext: DSQ consume and move paths operate on a task still being dispatchedCVE-2026-99269 · Linux kernel sched_ext (DSQ consume/move racing SCX_OPSS_DISPATCHING)High
• xrdp: out-of-bounds read parsing Confirm Active PDU crashes the server or leaks process memoryCVE-2026-33516 · xrdp (RDP capability exchange, Confirm Active PDU parsing)High
• Linux kernel virtio-gpu: unvalidated EDID block offset lets a malicious backend read past a kernel bufferCVE-2026-68255 · Linux kernel drm/virtio (virtio_get_edid_block response bounds)High