CVE-2026-46330

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The vulnerable code is reached only via the local setsockopt(TCP_ULP, "smc") syscall on a TCP socket owned by the caller; smc_ulp_init() is not invoked from packet receive or any remote network path. The bug is triggered exclusively through the setsockopt(2) syscall on a TCP socket owned by the attacker; smc_ulp_init() is registered as a TCP ULP handler and is invoked from do_tcp_setsockopt() → tcp_set_ulp(), not from any network packet-receive or remote protocol path.

AC:LAttack complexity, low

On systems with CONFIG_SMC enabled, an attacker fully controls socket creation, the pre-connect setsockopt call, and subsequent close/dup/fork races needed to trigger the corrupted VFS state and resulting UAF. An attacker fully controls socket creation, the setsockopt(TCP_ULP, "smc") call, and subsequent lifecycle operations (close, dup, connect); once preconditions are met the VFS corruption in smc_ulp_init() is deterministic and UAF/double-free can be provoked on demand without conditions outside attacker control.

PR:LPrivileges required, low

Any unprivileged local user who can open a TCP socket may call setsockopt(TCP_ULP); module autoload uses CAP_NET_ADMIN which is obtainable in user namespaces, and no real-root capability is required when SMC is already loaded. No real-root capability is required—any unprivileged local user who can create a SOCK_STREAM TCP socket and call setsockopt on it can reach smc_ulp_init(), including via user namespaces; TCP_ULP has no CAP_NET_ADMIN gate (unlike TCP congestion control), and module autoload is only needed if SMC is not already loaded.

UI:NUser interaction, none

Exploitation requires no action from another user or administrator; the attacker triggers the bug directly through their own socket file descriptor. Exploitation requires no action from a victim user; a local attacker can open a socket, invoke setsockopt(TCP_ULP, "smc"), and trigger the corrupted VFS state through normal close/dup operations in their own process.

S:UScope, unchanged

Impact is confined to kernel memory corruption and privilege escalation within the same kernel security boundary, not a cross-boundary escape such as guest-to-host or IOMMU bypass. Impact is confined to kernel memory corruption and privilege escalation within the same kernel security authority; this is not a VM escape, IOMMU bypass, or cross-security-boundary escape.

C:HConfidentiality impact, high

The in-place swapping of file, dentry, and inode pointers breaks VFS lifetime invariants and creates use-after-free conditions that can be leveraged for arbitrary kernel memory disclosure. The in-place swapping of file, dentry, and inode pointers breaks VFS lifetime invariants and creates use-after-free conditions that can be leveraged for arbitrary kernel memory disclosure. The fix commit and Al Viro's report explicitly identify use-after-free risk from in-place modification of struct file, dentry, and inode on an open file descriptor, which can yield arbitrary kernel memory read primitives through corrupted inode/file reference counting.

I:HIntegrity impact, high

UAF and broken VFS reference counting on live file descriptors enable heap grooming and arbitrary kernel write/control-flow hijacking, not merely a bounded or cosmetic corruption.

A:HAvailability impact, high

The design flaw causes use-after-free, double-free, and general system instability during file close/__fput paths, readily producing kernel oops/panic and complete denial of service on affected IBM Z/RoCE systems running SMC.