---
id: CVE-2026-80984
title: 'net/smc: do not dereference an unset send buffer on the SMC-D teardown path'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/smc: do not dereference an unset send buffer on the SMC-D teardown path

  smc_close_stream_wait() calls smc_tx_prepared_sends() from inside its
  sk_wait_event() condi…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-476
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 21f6f41e82e59740e26e06e77bdf58dc7f6f08dd <
    ab26e12dd5d2f43d939fcf456933a816e81d2e51
  - >-
    Linux >= ae2be35cbed2c8385e890147ea321a3fcc3ca5fa <
    e3fcff8d22a6c9540748846cd800443a643553a6
  - >-
    Linux >= ae2be35cbed2c8385e890147ea321a3fcc3ca5fa <
    f950e1b1f0aad334f9a9ee552c4dd5b794ebdd45
  - >-
    Linux >= ae2be35cbed2c8385e890147ea321a3fcc3ca5fa <
    f517cf02033801a28f98d86ca613a3533cf066b3
  - >-
    Linux >= ae2be35cbed2c8385e890147ea321a3fcc3ca5fa <
    b395dd319cea422239cb45b998fb38d7e373af87
  - Linux >= 6.6.66 < 6.6.157
  - Linux 6.10
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:46:08.671Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80984'
references:
  - url: 'https://git.kernel.org/stable/c/ab26e12dd5d2f43d939fcf456933a816e81d2e51'
  - url: 'https://git.kernel.org/stable/c/e3fcff8d22a6c9540748846cd800443a643553a6'
  - url: 'https://git.kernel.org/stable/c/f950e1b1f0aad334f9a9ee552c4dd5b794ebdd45'
  - url: 'https://git.kernel.org/stable/c/f517cf02033801a28f98d86ca613a3533cf066b3'
  - url: 'https://git.kernel.org/stable/c/b395dd319cea422239cb45b998fb38d7e373af87'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80984.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-80984'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532437'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-80984'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-80984'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80984.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00206
epssPercentile: 0.10486
ingestedAt: '2026-09-14T15:23:07.454Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/smc: do not dereference an unset send buffer on the SMC-D teardown path

smc_close_stream_wait() calls smc_tx_prepared_sends() from inside its
sk_wait_event() condition, and sk_wait_event() evaluates that condition
once with the socket lock released. smcd_buf_detach() clears
conn->sndbuf_desc from smc_conn_kill() under lock_sock(), so a link group
terminating while a socket waits there leaves the helper dereferencing
NULL, faulting out of close(). SIOCOUTQ reads the field by hand, and
smc_close_cancel_work() drops the lock across two cancel_*_sync() calls.

Sample the pointer once in the helper, report nothing prepared while it is
unset, and bound the ioctl the same way. The receive tasklet dereferences
the field directly in smc_cdc_msg_recv_action(), not through this helper;
1/2 is what keeps it from running that late.

## Affected

- `Linux >= 21f6f41e82e59740e26e06e77bdf58dc7f6f08dd < ab26e12dd5d2f43d939fcf456933a816e81d2e51`
- `Linux >= ae2be35cbed2c8385e890147ea321a3fcc3ca5fa < e3fcff8d22a6c9540748846cd800443a643553a6`
- `Linux >= ae2be35cbed2c8385e890147ea321a3fcc3ca5fa < f950e1b1f0aad334f9a9ee552c4dd5b794ebdd45`
- `Linux >= ae2be35cbed2c8385e890147ea321a3fcc3ca5fa < f517cf02033801a28f98d86ca613a3533cf066b3`
- `Linux >= ae2be35cbed2c8385e890147ea321a3fcc3ca5fa < b395dd319cea422239cb45b998fb38d7e373af87`
- `Linux >= 6.6.66 < 6.6.157`
- `Linux 6.10`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · updated 2026-09-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80984.json)