{"id":"CVE-2026-98559","title":"kernel: net/smc: fix UAF on lgr list traversal in smcr_port_err() (CVE-2026-98559)","summary":"A flaw was found in the Linux kernel's Shared Memory Communications (SMC) subsystem. When processing port errors, the kernel traverses active link groups without holding the appropriate lock, allowing a concurrent termination event to free…","severity":"medium","cvss":4.7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-825","vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","affected":["enterprise_linux 10","enterprise_linux 8","enterprise_linux 9","openshift_container_platform 4"],"published":"2026-10-18","updated":"2026-10-20","sourceUpdated":"2026-10-20T02:22:04+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98559.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98559.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-98559"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2555033"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-98559"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98559"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98559.mbox"},{"url":"https://git.kernel.org/stable/c/34bcf11cd2528ae00bb6d764d808083c66824277"},{"url":"https://git.kernel.org/stable/c/0edcc4284392b28826b5d37532b366b291e6e0fa"},{"url":"https://git.kernel.org/stable/c/00a59600ae72d24859d0ad1783a78bc921bc2599"},{"url":"https://git.kernel.org/stable/c/3d35f069e1c119992000d51236dbe54da2d4e61e"},{"url":"https://git.kernel.org/stable/c/3d65a2eb4449fc9658fb860dea893025d028d90e"},{"url":"https://git.kernel.org/stable/c/a9b968e42690d784c241a0761c10253271f7df5d"},{"url":"https://git.kernel.org/stable/c/61cb282fe97b3b0ba32ca09417a693162bf4ae3f"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.00211,"epssPercentile":0.11314,"ingestedAt":"2026-10-18T15:45:12.262Z","slug":"CVE-2026-98559","body":"## Overview\n\nA flaw was found in the Linux kernel's Shared Memory Communications (SMC) subsystem. When processing port errors, the kernel traverses active link groups without holding the appropriate lock, allowing a concurrent termination event to free memory while it is still in use. An attacker capable of inducing these concurrent network events could exploit this race condition to trigger a use-after-free flaw, leading to a Denial of Service (DoS) via a system crash.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-10-20 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98559.json)\n\n**kernel: net/smc: fix UAF on lgr list traversal in smcr_port_err()** — rated Moderate by Red Hat. Released 2026-10-18, updated 2026-10-20.\n\nAffected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n\nNo fix planned:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n\nNot affected:\n\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n\n## Remediation\n\nFix deferred","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":25.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":225808,"id":"CVE-2026-98559","ts":1792498461194,"field":"cvss","old":null,"new":"4.7"},{"seq":225807,"id":"CVE-2026-98559","ts":1792498461194,"field":"severity","old":"none","new":"medium"}]}