CVE-2026-74493

Received Received - Intake

Use-After-Free in Linux Kernel SMC Module

Publication date: 2026-08-15

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket use-after-free during link group termination __smc_lgr_terminate() drops conns_lock after finding a connection in lgr->conns_all, but before taking a reference on its socket. The connection is embedded in the socket, and its registration reference protects it only while the connection remains in the tree. A concurrent close can unregister the connection and drop that reference, freeing the socket before the termination worker reaches sock_hold(). The race is reachable when close overlaps link group termination. Local stress testing reproduced the use-after-free and KASAN reported: BUG: KASAN: slab-use-after-free in __smc_lgr_terminate.part.0 [smc] Write of size 4 by task kworker/3:3 Workqueue: events smc_lgr_terminate_work [smc] __smc_lgr_terminate.part.0 [smc] The socket was allocated by smc_create(), freed through slab_free_after_rcu_debug(), and was followed by: refcount_t: addition on 0; use-after-free. __smc_lgr_terminate.part.0 [smc] Take the socket reference while conns_lock still protects the tree entry. The unregister path then cannot drop the last reference until termination has finished using the socket.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-19

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74493

EUVD

EUVD-2026-59686

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's SMC (Socket Direct Protocol) implementation. It occurs when a connection is terminated while another process is closing it, leading to a race condition where the socket is freed before the termination process completes. The issue arises because the termination function drops a lock before securing a reference to the socket, allowing concurrent operations to free the socket prematurely.

Detection Guidance

This vulnerability is specific to the Linux kernel's SMC (Socket Direct) module and may not have direct detection commands. However, enabling KASAN (Kernel Address Sanitizer) in the kernel can help detect use-after-free issues like this. Monitor kernel logs for KASAN reports indicating slab-use-after-free errors in the smc module.

Impact Analysis

This vulnerability could cause system crashes or instability if exploited. It may lead to denial-of-service conditions where affected services become unresponsive. In severe cases, it might allow limited privilege escalation or information leaks, though exploitation is complex and requires specific timing conditions.

Compliance Impact

This vulnerability is a use-after-free flaw in the Linux kernel's SMC (Socket Direct) networking subsystem. It does not directly relate to data protection, privacy, or security controls required by standards like GDPR or HIPAA. The issue is localized to kernel memory management during network connection termination and does not involve unauthorized data access or processing of sensitive information.

Mitigation Strategies

Apply the latest kernel patches or updates that address this issue. If patches are not yet available, consider disabling the SMC module (smc) if it is not required. Monitor vendor advisories for updates and test patches in a non-production environment before deployment.

Hi! I’m here to help you understand CVE-2026-74493. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70