CVE-2026-80979: net/smc: unregister the connection before draining the rx tasklet
In the Linux kernel, the following vulnerability has been resolved:
net/smc: unregister the connection before draining the rx tasklet
smcconnfree() calls smcismunsetconn() only while the link group is still on its device list, and never sets conn->killed. smclgrterminatesched() unlinks the group immediately and defers killing its connections to a work item, so a connection freed in that window keeps its smcd->conn[] slot with both gates in smcdhandleirq() open, and the device can re-arm the receive tasklet after taskletkill() has returned. On the DMB-nocopy path the ghost send buffer is freed right after that drain, so the re-armed tasklet dereferences it.
Unregister unconditionally and drain before the detach at both teardown sites, mirroring rmbdesc, which smcbufunuse() releases after the drain. Clear conn->sndbufdesc before freeing it as well, so a reader that samples the pointer cannot get one that is already freed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
In the net/smc teardown paths, unregister the connection unconditionally before draining the receive tasklet, drain before detaching at both teardown sites, and clear conn->sndbuf_desc before freeing the send buffer so a re-armed tasklet cannot dereference freed memory.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
The issue applies to Linux kernel systems using the net/smc subsystem, specifically when the DMB-nocopy path is in use. Exposure depends on a connection teardown occurring while its link group has been detached and receive tasklet activity can be re-armed.
What condition triggers the unsafe access?
A connection can be freed after its link group is removed from the device list but before deferred connection cleanup marks it killed. In that interval, interrupt handling can re-arm the receive tasklet after it was drained, and the re-armed tasklet can dereference a send buffer that has already been freed.
How can I determine whether my kernel includes the fix?
Check whether the kernel's SMC teardown paths unregister the connection and drain the receive tasklet before detaching it, and whether sndbuf_desc is cleared before its buffer is freed. The listed stable-kernel commit references identify implementations containing the remediation.