CVE-2026-64005

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

Exploitation requires winning a race during SMC module initialization by concurrently calling socket(PF_SMC)/socket(AF_INET, SOCK_STREAM, IPPROTO_SMC) syscalls. The bug is not reachable from remote network packet handling; SMC network upgrade paths operate only after initialization completes.

AC:LAttack complexity, low

An attacker controls both sides of the race by spawning concurrent threads that hammer socket creation while another thread triggers SMC module autoload via request_module("net-pf-43") during sock_register(). The vulnerable window between sock_register() and INIT_HLIST_HEAD() is narrow but attacker-driven and repeatable on each module load/reload.

PR:LPrivileges required, low

Creating PF_SMC or IPPROTO_SMC sockets requires only an unprivileged local user account; no CAP_NET_ADMIN, CAP_SYS_MODULE, or real root in the initial namespace is needed to participate in the race when module autoload is enabled. Triggering module load may require admin action on hardened systems, but the corrupting socket operations themselves need only basic local privileges.

UI:NUser interaction, none

No victim interaction is required beyond the attacker's own concurrent socket creation during module initialization; no mount, file open, or other user action is needed.

S:UScope, unchanged

Impact is confined to kernel memory corruption and privilege escalation within the same kernel security boundary; this is not a VM escape, IOMMU bypass, or cross-authority sandbox escape.

C:HConfidentiality impact, high

Resetting smc_v4/v6_hashinfo.ht after sockets are hashed orphans live sk_node entries; subsequent hlist traversal in smc_diag_dump_proto() or corrupted pointer chasing can read arbitrary kernel memory adjacent to socket structures.

I:HIntegrity impact, high

Orphaned hlist nodes cause __hlist_del() in smc_unhash_sk() to write through stale pprev/next pointers when corrupted sockets are closed, enabling exploitable kernel heap/list corruption and potential control-flow hijacking.

A:HAvailability impact, high

List corruption reliably causes kernel oops or panic when orphaned sockets are unhashed (__hlist_del with NULL next) or when the corrupted hashtable is walked, resulting in complete loss of kernel availability.