{"id":"CVE-2026-52941","title":"net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint\n\nThe smc_msg_event tracepoint class, shared by smc_tx_sendmsg and\nsmc_rx_recvmsg, unconditionally der…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= aff3083f10bff7a37eaa2b4e6bc5fb627ddd5f84 < 68200112534bb2acd1d7117dc2d5c124868d866d","Linux >= aff3083f10bff7a37eaa2b4e6bc5fb627ddd5f84 < 720c76b930c52cd58f50eb6b10569d03dccc7959","Linux >= aff3083f10bff7a37eaa2b4e6bc5fb627ddd5f84 < b706d6d76a2a2793fe5ad0fbc2a75b6a460094ef","Linux >= aff3083f10bff7a37eaa2b4e6bc5fb627ddd5f84 < d2ea0b8aef8746e147602eac87ca8538f4bc7e66","Linux >= aff3083f10bff7a37eaa2b4e6bc5fb627ddd5f84 < 561cf66fa9b6c86dfe4e687d2d1aeaaa6739917f","Linux >= aff3083f10bff7a37eaa2b4e6bc5fb627ddd5f84 < 7bf563badd37cb796df5477d2b78bb64148a1268","Linux 5.16"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:14:36.633937Z"},"published":"2026-06-24","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:23:50.565Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-52941","references":[{"url":"https://git.kernel.org/stable/c/68200112534bb2acd1d7117dc2d5c124868d866d"},{"url":"https://git.kernel.org/stable/c/720c76b930c52cd58f50eb6b10569d03dccc7959"},{"url":"https://git.kernel.org/stable/c/b706d6d76a2a2793fe5ad0fbc2a75b6a460094ef"},{"url":"https://git.kernel.org/stable/c/d2ea0b8aef8746e147602eac87ca8538f4bc7e66"},{"url":"https://git.kernel.org/stable/c/561cf66fa9b6c86dfe4e687d2d1aeaaa6739917f"},{"url":"https://git.kernel.org/stable/c/7bf563badd37cb796df5477d2b78bb64148a1268"}],"tags":["cve.org"],"epss":0.00119,"epssPercentile":0.01768,"ingestedAt":"2026-11-06T16:57:43.309Z","slug":"CVE-2026-52941","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint\n\nThe smc_msg_event tracepoint class, shared by smc_tx_sendmsg and\nsmc_rx_recvmsg, unconditionally dereferences smc->conn.lnk:\n\n\t__string(name, smc->conn.lnk->ibname)\n\nconn->lnk is only set for SMC-R; for SMC-D it is NULL. Other code on\nthese paths already handles this (e.g. !conn->lnk in\nSMC_STAT_RMB_TX_SIZE_SMALL()). With the tracepoint enabled, the first\nsendmsg()/recvmsg() on an SMC-D socket crashes:\n\n  Oops: general protection fault, probably for non-canonical address\n  KASAN: null-ptr-deref in range [...]\n  RIP: 0010:strlen+0x1e/0xa0\n  Call Trace:\n   trace_event_raw_event_smc_msg_event (net/smc/smc_tracepoint.h:44)\n   smc_rx_recvmsg (net/smc/smc_rx.c:515)\n   smc_recvmsg (net/smc/af_smc.c:2859)\n   __sys_recvfrom (net/socket.c:2315)\n   __x64_sys_recvfrom (net/socket.c:2326)\n   do_syscall_64\n\nThe faulting address 0x3e0 is offsetof(struct smc_link, ibname),\nconfirming the NULL ->lnk deref. Enabling the tracepoint requires\nroot, but the trigger itself is unprivileged: socket(AF_SMC, ...) has\nno capability check, and SMC-D negotiation needs no admin step on\ns390 or on x86 with the loopback ISM device loaded.\n\nLog an empty device name for SMC-D instead of dereferencing NULL.\n\n## Affected\n\n- `Linux >= aff3083f10bff7a37eaa2b4e6bc5fb627ddd5f84 < 68200112534bb2acd1d7117dc2d5c124868d866d`\n- `Linux >= aff3083f10bff7a37eaa2b4e6bc5fb627ddd5f84 < 720c76b930c52cd58f50eb6b10569d03dccc7959`\n- `Linux >= aff3083f10bff7a37eaa2b4e6bc5fb627ddd5f84 < b706d6d76a2a2793fe5ad0fbc2a75b6a460094ef`\n- `Linux >= aff3083f10bff7a37eaa2b4e6bc5fb627ddd5f84 < d2ea0b8aef8746e147602eac87ca8538f4bc7e66`\n- `Linux >= aff3083f10bff7a37eaa2b4e6bc5fb627ddd5f84 < 561cf66fa9b6c86dfe4e687d2d1aeaaa6739917f`\n- `Linux >= aff3083f10bff7a37eaa2b4e6bc5fb627ddd5f84 < 7bf563badd37cb796df5477d2b78bb64148a1268`\n- `Linux 5.16`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}