CVE-2026-64048

Analyzed Analyzed - Analysis Complete

Null Pointer Dereference in Linux Kernel SMC

Publication date: 2026-07-19

Last updated on: 2026-09-02

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot On the SMC-D client, slot 0 of ini->ism_dev[]/ini->ism_chid[] is reserved for an SMC-Dv1 device. smc_find_ism_v2_device_clnt() populates V2 entries starting at index 1, so when no V1 device is selected slot 0 is left in its kzalloc()'ed state with ism_dev[0] == NULL and ism_chid[0] == 0. smc_v2_determine_accepted_chid() then matches the peer's CHID against the array starting from index 0 using the CHID alone. A malicious peer replying to a SMC-Dv2-only proposal with d1.chid == 0 matches the empty slot, ini->ism_selected becomes 0, and the subsequent ism_dev[0]->lgr_lock dereference in smc_conn_create() faults at offsetof(struct smcd_dev, lgr_lock) == 0x68: BUG: KASAN: null-ptr-deref in _raw_spin_lock_bh+0x79/0xe0 Write of size 4 at addr 0000000000000068 by task exploit/144 Call Trace: _raw_spin_lock_bh smc_conn_create (net/smc/smc_core.c:1997) __smc_connect (net/smc/af_smc.c:1447) smc_connect (net/smc/af_smc.c:1720) __sys_connect __x64_sys_connect do_syscall_64 Require ism_dev[i] to be non-NULL before accepting a CHID match.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-09-02

Generated

2026-09-18

AI Q&A

2026-07-19

EPSS Evaluated

2026-09-15

NVD

CVE-2026-64048

EUVD

EUVD-2026-45621

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.16 (inc) to 6.1.175 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.92 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.34 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.142 (exc)
linux	linux_kernel	From 5.10 (inc) to 5.10.266 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.217 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-476	The product dereferences a pointer that it expects to be valid but is NULL.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the SMC-D (Shared Memory Communications over RDMA) client implementation. A malicious peer can exploit a reserved slot in the device array by sending a CHID (Connection Handle ID) of 0, which matches an empty slot. This causes a null pointer dereference when the kernel attempts to access the device's lock, leading to a kernel crash or potential privilege escalation.

Detection Guidance

This vulnerability involves a null-pointer dereference in the Linux kernel's SMC (Socket Messaging Channel) module. Detection requires checking for kernel crashes or specific error messages related to smc_conn_create() or _raw_spin_lock_bh. Monitor system logs for KASAN errors or kernel oopses. No specific commands are provided in the context to detect this issue.

Impact Analysis

If exploited, this vulnerability could allow an attacker to crash the system or gain elevated privileges, potentially leading to unauthorized access or denial of service. Systems using the affected Linux kernel versions with SMC-D enabled are at risk.

Compliance Impact

This vulnerability is a null-pointer dereference flaw in the Linux kernel's SMC (Socket Messaging over RDMA) subsystem. It does not directly relate to data privacy, security controls, or compliance requirements such as GDPR or HIPAA. The issue is a system crash due to improper handling of network connections, which could lead to denial of service but does not inherently violate compliance standards.

Mitigation Strategies

Update the Linux kernel to a patched version that resolves this issue. Monitor for unusual network activity or crashes related to SMC-D connections. Disable SMC-D if not required until patched.

Hi! I’m here to help you understand CVE-2026-64048. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70