CVE-2026-80980

Received Received - Intake

Race Condition in Linux Kernel SMC Connection State Flags

Publication date: 2026-09-11

Last updated on: 2026-09-13

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net/smc: stop killed, freed and out_of_sync sharing a byte The three connection state flags are single-bit bitfields, so they occupy one byte of struct smc_connection and every store to one is a read-modify-write of the other two: u8 killed : 1; u8 freed : 1; u8 out_of_sync : 1; They are not written under a common lock. smc_cdc_msg_validate() sets out_of_sync from the receive tasklet, while smc_conn_kill() sets killed from process context under lock_sock(), and the receive path does not defer to the backlog when the socket is owned -- smc_cdc_msg_recv() takes only bh_lock_sock(). Give each flag its own byte so a store no longer touches its neighbours. All readers test them as booleans and are unchanged. struct smc_connection grows by two bytes.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-13

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-09-29

NVD

CVE-2026-80980

EUVD

EUVD-2026-76303

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where three connection state flags (killed, freed, out_of_sync) share a single byte in the smc_connection structure. Each flag is a single bit, but modifying one requires reading and rewriting the entire byte, affecting the other flags. This can lead to race conditions as the flags are not protected by a common lock.

Detection Guidance

This vulnerability is specific to the Linux kernel's SMC (Socket Direct) implementation and involves race conditions in connection state flags. Detection requires kernel source code analysis or specialized tools that monitor for memory corruption or race conditions in the SMC subsystem. No direct commands are provided in the context to detect this issue.

Impact Analysis

This vulnerability could cause memory corruption or unexpected behavior in the Linux kernel's SMC (Socket Messaging Channel) module. It may lead to system crashes, data corruption, or security issues if exploited to manipulate connection states.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level kernel memory corruption issue in the Linux SMC (Socket Direct Protocol) implementation. It may indirectly impact compliance if exploited to cause system instability or data corruption, but no evidence suggests direct regulatory implications.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Since the vulnerability is resolved in a specific kernel version, updating to a patched kernel version is the primary mitigation step. Monitor vendor advisories for kernel updates.

Hi! I’m here to help you understand CVE-2026-80980. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70