Linux kernel net/smc: Use-after-free and NULL dereference in smc_getname
Summary
A race condition in the Linux kernel's SMC socket code (net/smc) lets smc_getname() use the CLC socket after it has been released during link-group termination. A local user with a low-privilege account who calls getsockname() on an SMC socket at the right time can trigger a use-after-free or NULL dereference. Successful exploitation could lead to a crash or further impact on confidentiality, integrity and availability, but the attack requires local access and timing.
Affected
- Linux kernel from 5.1 onward, as listed in the CVE record and OSV (ranges differ per stable branch).
- The CVE record also lists 4.19.299 up to, but not including, 4.20.
Fixed in
- Stable releases 5.10.273, 5.15.224, 6.1.191, 6.6.160, 6.12.113, 6.18.57 and 7.2.11 according to OSV.
- Check your distribution's kernel advisory for the fixed package build, as distributions may backport the fix differently.
Workaround
- No vendor workaround known.
- If no workload needs SMC, unloading or blacklisting the smc module reduces exposure until the kernel is patched. Test first.
Exploitation
- No known exploitation in the wild found.
- No public proof of concept found.
- Not checked against CISA KEV. Ubuntu lists the issue as needing evaluation with Medium priority.
Our recommendation
- Patch Linux kernels in the normal update cycle, prioritising multi-user servers, shared hosts and systems running untrusted code or containers.
- Check whether SMC is loaded (lsmod | grep smc) and whether any workload needs it.
- Monitor your distribution's advisories for the fixed kernel build.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Upstream fix commit 64a6b36b (stable kernel) git.kernel.org
- Upstream fix commit 5d0fa089 (stable kernel) git.kernel.org
- Upstream fix commit e607017a (stable kernel) git.kernel.org
- Ubuntu CVE tracker ubuntu.com
- OSV record osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 22:26.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: net/smc: protect clcsock lifetime in smc_getname smc_getname() dereferences smc->clcsock without holding clcsock_release_lock. Link-group termination can release the CLC socket through smc_close_active_abort() while the SMC socket is still open, for example after shutdown(SHUT_WR). A getsockname() caller can load smc->clcsock, then the termination worker can clear the pointer and call sock_release() before the caller accesses clcsock->ops or invokes getname(). This causes a use-after-free; if the worker clears the pointer before the load, it causes a NULL dereference. The syscall's file reference keeps the SMC socket alive but does not prevent asynchronous release of its CLC socket. KASAN reported the following with test-only timing instrumentation: BUG: KASAN: slab-use-after-free in smc_getname+0x19e/0x1b0 Read of size 8 at addr ffff888109abb4e0 by task poc/103 Call Trace: smc_getname+0x19e/0x1b0 do_getsockname+0xe5/0x170 __sys_getsockname+0x8c/0x100 Allocated by task 95: sock_alloc_inode+0x1e/0x280 sock_alloc+0x3d/0x240 __sock_create+0x7e/0x430 smc_create+0x121/0x240 Freed by task 0: kmem_cache_free+0xcc/0x340 rcu_core+0x50a/0x1850 Last potentially related work creation: evict+0x446/0x6c0 smc_clcsock_release+0xa8/0xd0 smc_close_active_abort+0x26a/0x3a0 __smc_lgr_terminate.part.0+0x137/0x2e0 Hold clcsock_release_lock across the pointer check and the getname() callback to serialize with smc_clcsock_release(). Return -EBADF if the CLC socket has already been released, preserving the existing peer state check and the callback's return value otherwise.
NVD references (8)
- https://git.kernel.org/stable/c/04069199816285c49199a35971f4298199609687
- https://git.kernel.org/stable/c/1512e3714b3946bda75a160a34f22a51710daa43
- https://git.kernel.org/stable/c/5d0fa089d5ed497366ea5c000c6eefb346c7cb01
- https://git.kernel.org/stable/c/64a6b36b0e1855288080bc5f89769f27d6dc03c8
- https://git.kernel.org/stable/c/6a1833f0d7dc037c8e876b9178ba69d5d107c086
- https://git.kernel.org/stable/c/94a43efd71ad440c35dd469559d3a6d665f102d9
- https://git.kernel.org/stable/c/c223da71abfaea2ebb1c7208ae9ebf15038f9388
- https://git.kernel.org/stable/c/e607017a553d2a48e428ec8b8ffb06bf3bb92ce9
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.