CVE-2026-80982

Received Received - Intake

Use-After-Free in Linux Kernel SMC Module

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free in smc_rx_pipe_buf_release() smc_rx_splice() hands RMB pages to a pipe and takes a socket reference per entry so the smc_sock stays alive until the reader finishes. The connection does not: a concurrent close runs smc_conn_free(), which releases the receive buffer back to the link group pool. smc_rx_pipe_buf_release() tests sk_state before taking the socket lock. The state can change between the test and the lock, and smc_rx_update_cons() then dereferences conn->rmb_desc and walks conn->lgr, which smc_conn_free() has already released. On the is_reg_err path smcr_buf_unuse() frees the descriptor outright, so this is a use-after-free. Take the socket lock first and test conn->freed instead. smc_conn_free() sets that flag before releasing anything, and every caller holds the socket lock. The two paths exclude each other: either the pipe release runs first with everything valid, or it sees the flag and skips the update.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-80982

EUVD

EUVD-2026-76305

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's SMC (Socket Direct Protocol) implementation. It occurs when smc_rx_splice() passes pages to a pipe but a concurrent connection close frees the receive buffer before smc_rx_pipe_buf_release() finishes processing. The issue arises because smc_rx_pipe_buf_release() checks socket state without proper locking, leading to access of freed memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's SMC (Socket Direct) implementation and requires kernel-level inspection. Detection involves checking kernel logs for use-after-free errors in SMC-related components or monitoring for crashes in smc_rx_pipe_buf_release() or smc_conn_free(). Use commands like dmesg | grep smc or journalctl -k | grep -i smc to search for related errors. If you suspect exploitation, inspect kernel memory for corrupted SMC structures.

Impact Analysis

This vulnerability could allow an attacker to cause a system crash or execute arbitrary code with kernel privileges. It affects systems using the SMC protocol, potentially leading to denial-of-service conditions or privilege escalation if exploited.

Mitigation Strategies

Immediate mitigation requires updating the Linux kernel to a patched version that resolves CVE-2026-80982. Check your distribution's security advisories for kernel updates. If patching is not immediately possible, disable SMC (Socket Direct) functionality by unloading the smc kernel module (rmmod smc) or disabling it via kernel parameters. Monitor for signs of exploitation or system instability.

Hi! I’m here to help you understand CVE-2026-80982. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70