Look up another CVE · open CVE-2026-80982 in the interactive tracker
CVE-2026-80982
net/smc: fix use-after-free in smc_rx_pipe_buf_release()
Published 2026-09-11 (37 days ago) by the Linux kernel CNA. Subsystem net/smc. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-80982 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4841-1 · 2026-10-17 · text | 6.1.190-1 | Update the kernel and reboot. DLA-4841-1 shipped the fix on 2026-10-17, in 6.1.190-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6528-1 · 2026-09-29 · text | 6.12.111-1 | Update the kernel and reboot. DSA-6528-1 shipped the fix on 2026-09-29, in 6.12.111-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4817-1 · 2026-10-04 · text | 6.12.111-1~deb12u1 | Update the kernel and reboot. DLA-4817-1 shipped the fix on 2026-10-04, in 6.12.111-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
smc_rx_splice() hands RMB pages to a pipe and takes a socket reference per entry so the smc_sock stays alive until the reader finishes. The connection does not: a concurrent close runs smc_conn_free(), which releases the receive buffer back to the link group pool. smc_rx_pipe_buf_release() tests sk_state before taking the socket lock. The state can change between the test and the lock, and smc_rx_update_cons() then dereferences conn->rmb_desc and walks conn->lgr, which smc_conn_free() has already released. On the is_reg_err path smcr_buf_unuse() frees the descriptor outright, so this is a use-after-free. Take the socket lock first and test conn->freed instead. smc_conn_free() sets that flag before releasing anything, and every caller holds the socket lock. The two paths exclude each other: either the pipe release runs first with everything valid, or it sees the flag and skips the update.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/smc/smc_rx.c
- What this is
- SHARED MEMORY COMMUNICATIONS (SMC) SOCKETSMAINTAINERS section matched on net/smc/ · linux-rdma@vger.kernel.org · Supported
- Kernel module
- smc
Check it on the machine
grep -w CONFIG_SMC /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w smcPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian does not build this code in 2 releases. It does build it in 3 releases, so the answer depends on which release the machine runs.
- bookworm, trixiem
- forky, sidn
- bookworm · linux-6.12m
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- n
- not enabled on any flavour - this release does not build the code
- Build switch
- CONFIG_SMC
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-11 (37 days ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.16%, higher than 5.2% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/smc
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.18 | 6.1.188 | dadd97c8296b |
| 4.18 | 6.6.157 | df441f3efbb5 |
| 4.18 | 6.12.109 | 6a644a7340df |
| 4.18 | 6.18.50 | 0761e49aa78c |
| 4.18 | 7.2.4 | 0926f59ca0f9 |
| 4.18 | 7.3 | c924884743e9 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4841-1 | 2026-10-17 | bookworm 6.1.190-1 | tracker |
| DLA-4817-1 | 2026-10-04 | bookworm 6.12.111-1~deb12u1 | tracker |
| DSA-6528-1 | 2026-09-29 | trixie 6.12.111-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The UAF is in smc_rx_pipe_buf_release(), a pipe_buf_ops.release callback reached only via local splice() on an AF_SMC socket (syscall -> sock_splice_read -> smc_splice_read -> smc_rx_recvmsg -> smc_rx_splice). A remote SMC peer can supply RMB data or close the connection, but cannot invoke the splice pipe-buffer release path by itself.
- AC:LAttack complexity, low
- The attacker controls both sides of the TOCTOU: one thread splices SMC Rx data into a pipe and then reads or closes it (unlocked sk_state check, then lock_sock), while another closes the socket so smc_conn_free() drops rmb_desc/lgr in that window. The race is fully attacker-driven and retryable.
- PR:LPrivileges required, low
- socket(AF_SMC) or IPPROTO_SMC, connect/listen (loopback-ism, ISM, or RoCE), splice(2), and close(2) have no capability checks and are available to an unprivileged local user. User-namespace admin rights are not required.
- UI:NUser interaction, none
- A single unprivileged process can act as both SMC endpoints on loopback or a local fabric, splice received data into a pipe, and race close() against pipe-buffer release. No victim user action is required.
- S:UScope, unchanged
- The corruption is confined to kernel objects (smc_buf_desc, smc_link_group) in the same kernel security authority. This is standard kernel memory corruption, not a VM, IOMMU, or sandbox boundary escape.
- C:HConfidentiality impact, high
- smc_rx_update_cons() dereferences conn->rmb_desc and walks conn->lgr after smc_conn_free()/smcr_buf_unuse() released them; on the is_reg_err path smc_buf_free() frees the descriptor outright. Per kernel CVSS guidance, this UAF of heap objects enables arbitrary kernel-memory disclosure.
- I:HIntegrity impact, high
- The same UAF writes consumer cursors and may call smc_tx_consumer_update() -> smc_cdc_get_slot_and_msg_send() or queue_delayed_work on conn->lgr->tx_wq after the link group is freed, enabling heap reuse, arbitrary write, and control-flow hijack.
- A:HAvailability impact, high
- Dereferencing the freed rmb_desc or link group produces a kernel oops or panic. Use-after-free on this path crashes the host even when not fully exploited, and the attacker can repeat the race at will.