CVE-2026-64541Critical· 9.8▾ MidnightIn the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket smc_cdc_rx_handler() looks up the connection by token under the link group's conns_lock, drops the lock,…
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 53.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.6%
Last analysed / modified upstream
In the Linux kernel, the following vulnerability has been resolved:
net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket
smc_cdc_rx_handler() looks up the connection by token under the link group's conns_lock, drops the lock, and then dereferences conn and the smc_sock derived from it, ending in sock_hold(&smc->sk) inside smc_cdc_msg_recv(). No reference is held across the lock release.
The only reference pinning the socket while the connection is discoverable in the link group is taken in smc_lgr_register_conn() (sock_hold) and dropped in __smc_lgr_unregister_conn() (sock_put), both under conns_lock. Once the handler drops conns_lock, a concurrent close() -> smc_release() -> smc_conn_free() -> smc_lgr_unregister_conn() can drop that reference and free the smc_sock, so the handler's later sock_hold() runs on freed memory:
WARNING: lib/refcount.c:25 at refcount_warn_saturate Workqueue: rxe_wq do_work refcount_warn_saturate (lib/refcount.c:25) smc_cdc_msg_recv (net/smc/smc_cdc.c:430) smc_cdc_rx_handler (net/smc/smc_cdc.c:502) smc_wr_rx_tasklet_fn (net/smc/smc_wr.c:445) tasklet_action_common (kernel/softirq.c:938) handle_softirqs (kernel/softirq.c:622) Kernel panic - not syncing: panic_on_warn set
Only SMC-R is affected. The SMC-D receive tasklet is stopped by tasklet_kill(&conn->rx_tsklet) in smc_conn_free() before the connection is unregistered, so it cannot run concurrently with the free.
Take the socket reference while still holding conns_lock, so the registration reference can no longer be the last one, and drop it once the handler is done.
Linux >= d7b0e37c1ac152905b18a5b9506179091a35b0b6 < 8de4f665d0febfb92803dece377791a563fc7041Linux >= d7b0e37c1ac152905b18a5b9506179091a35b0b6 < 8145b432136285e01091815b48ceb2dae261f262Linux >= d7b0e37c1ac152905b18a5b9506179091a35b0b6 < 1951bffbc6493ec34cff3956b29d4bc6606904a6Linux >= d7b0e37c1ac152905b18a5b9506179091a35b0b6 < 647b19e5cc145a2f1f685ae8ff3805a17356888cLinux >= d7b0e37c1ac152905b18a5b9506179091a35b0b6 < 472e9d7c0d5b03be3ff91ff941f57da822b031bcLinux >= d7b0e37c1ac152905b18a5b9506179091a35b0b6 < 3bfb96d9bc6a7ed0b99c7db329cc2e22a28d84bbLinux >= d7b0e37c1ac152905b18a5b9506179091a35b0b6 < ce5aa8084329351086894aa34d77e40301d5bd3dLinux >= d7b0e37c1ac152905b18a5b9506179091a35b0b6 < 9d160b35cc34a2ba8229d07651468a7848325135Linux 4.18Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-38564High· 7.8bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE
CVE-2026-99092Noneriscv: patch: fix handling of bpf-jit execmem addresses
CVE-2026-99089NoneASoC: samsung: i2s: enable op_clk in probe to balance runtime PM
CVE-2026-99093Nonemm: don't schedule deferred kernel page table freeing while booting
CVE-2026-99088Nonenet: openvswitch: validate transport header presence in set_ipv6_addr
CVE-2026-99090Nonedrm/amdgpu: serialize vblank counter reads against GPU reset