CVE-2026-64541

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket smc_cdc_rx_handler() looks up the connection by token under the link group's conns_lock, drops the lock, and then dereferences conn and the smc_sock derived from it, ending in sock_hold(&smc->sk) inside smc_cdc_msg_recv(). No reference is held across the lock release. The only reference pinning the socket while the connection is discoverable in the link group is taken in smc_lgr_register_conn() (sock_hold) and dropped in __smc_lgr_unregister_conn() (sock_put), b...

Affected product and versions

Product

Linux

Affected versions

>= d7b0e37c1ac152905b18a5b9506179091a35b0b6 < 8de4f665d0febfb92803dece377791a563fc7041, >= d7b0e37c1ac152905b18a5b9506179091a35b0b6 < 8145b432136285e01091815b48ceb2dae261f262, >= d7b0e37c1ac152905b18a5b9506179091a35b0b6 < 1951bffbc6493ec34cff3956b29d4bc6606904a6, >= d7b0e37c1ac152905b18a5b9506179091a35b0b6 < 647b19e5cc145a2f1f685ae8ff3805a17356888c, >= d7b0e37c1ac152905b18a5b9506179091a35b0b6 < 472e9d7c0d5b03be3ff91ff941f57da822b031bc, >= d7b0e37c1ac152905b18a5b9506179091a35b0b6 < 3bfb96d9bc6a7ed0b99c7db329cc2e22a28d84bb, >= d7b0e37c1ac152905b18a5b9506179091a35b0b6 < ce5aa8084329351086894aa34d77e40301d5bd3d, >= d7b0e37c1ac152905b18a5b9506179091a35b0b6 < 9d160b35cc34a2ba8229d07651468a7848325135, >= 4.18

Fixed versions

No verified fixed-version field is available yet

Technical data

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE

Not available