CVE-2026-80979: net/smc: unregister the connection before draining the rx tasklet
In the Linux kernel, the following vulnerability has been resolved:
net/smc: unregister the connection before draining the rx tasklet
smcconnfree() calls smcismunsetconn() only while the link group is still on its device list, and never sets conn->killed. smclgrterminatesched() unlinks the group immediately and defers killing its connections to a work item, so a connection freed in that window keeps its smcd->conn[] slot with both gates in smcdhandleirq() open, and the device can re-arm the receive tasklet after taskletkill() has returned. On the DMB-nocopy path the ghost send buffer is freed right after that drain, so the re-armed tasklet dereferences it.
Unregister unconditionally and drain before the detach at both teardown sites, mirroring rmbdesc, which smcbufunuse() releases after the drain. Clear conn->sndbufdesc before freeing it as well, so a reader that samples the pointer cannot get one that is already freed.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue applies to Linux kernel systems using the net/smc subsystem, specifically when the DMB-nocopy path is in use. Exposure depends on a connection teardown occurring while its link group has been detached and receive tasklet activity can be re-armed.
What condition triggers the unsafe access?
A connection can be freed after its link group is removed from the device list but before deferred connection cleanup marks it killed. In that interval, interrupt handling can re-arm the receive tasklet after it was drained, and the re-armed tasklet can dereference a send buffer that has already been freed.
How can I determine whether my kernel includes the fix?
Check whether the kernel's SMC teardown paths unregister the connection and drain the receive tasklet before detaching it, and whether sndbuf_desc is cleared before its buffer is freed. The listed stable-kernel commit references identify implementations containing the remediation.