CVE-2026-80979: net/smc: unregister the connection before draining the rx tasklet

Published Sep 11, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

net/smc: unregister the connection before draining the rx tasklet

smcconnfree() calls smcismunsetconn() only while the link group is still on its device list, and never sets conn->killed. smclgrterminatesched() unlinks the group immediately and defers killing its connections to a work item, so a connection freed in that window keeps its smcd->conn[] slot with both gates in smcdhandleirq() open, and the device can re-arm the receive tasklet after taskletkill() has returned. On the DMB-nocopy path the ghost send buffer is freed right after that drain, so the re-armed tasklet dereferences it.

Unregister unconditionally and drain before the detach at both teardown sites, mirroring rmbdesc, which smcbufunuse() releases after the drain. Clear conn->sndbufdesc before freeing it as well, so a reader that samples the pointer cannot get one that is already freed.

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 11, 2026
CVE Published
via MITRE·07:42 PM
Data Sourced
via MITRE·07:42 PM
Description

Frequently Asked Questions

1

Which systems are exposed to this issue?

The issue applies to Linux kernel systems using the net/smc subsystem, specifically when the DMB-nocopy path is in use. Exposure depends on a connection teardown occurring while its link group has been detached and receive tasklet activity can be re-armed.

2

What condition triggers the unsafe access?

A connection can be freed after its link group is removed from the device list but before deferred connection cleanup marks it killed. In that interval, interrupt handling can re-arm the receive tasklet after it was drained, and the re-armed tasklet can dereference a send buffer that has already been freed.

3

How can I determine whether my kernel includes the fix?

Check whether the kernel's SMC teardown paths unregister the connection and drain the receive tasklet before detaching it, and whether sndbuf_desc is cleared before its buffer is freed. The listed stable-kernel commit references identify implementations containing the remediation.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203