CVE-2026-80980: net/smc: stop killed, freed and out_of_sync sharing a byte
In the Linux kernel, the following vulnerability has been resolved:
net/smc: stop killed, freed and outofsync sharing a byte
The three connection state flags are single-bit bitfields, so they occupy one byte of struct smcconnection and every store to one is a read-modify-write of the other two:
u8 killed : 1; u8 freed : 1; u8 outofsync : 1;
They are not written under a common lock. smccdcmsgvalidate() sets outofsync from the receive tasklet, while smcconnkill() sets killed from process context under locksock(), and the receive path does not defer to the backlog when the socket is owned -- smccdcmsgrecv() takes only bhlocksock().
Give each flag its own byte so a store no longer touches its neighbours. All readers test them as booleans and are unchanged. struct smcconnection grows by two bytes.
Affected Software
Event History
Frequently Asked Questions
What conditions are required for this race to occur?
The race requires concurrent updates to SMC connection state flags from different contexts without a common lock. In particular, the receive tasklet can set out_of_sync while process-context code sets killed under lock_sock(), and the receive path uses only bh_lock_sock() rather than deferring when the socket is owned.
Which systems are exposed?
Systems using the Linux kernel's net/smc subsystem are relevant. The provided information does not identify affected kernel versions, configurations, or whether SMC must be actively in use for exposure.
What is the practical effect of the fix?
The fix stores killed, freed, and out_of_sync in separate bytes of struct smc_connection. This prevents a write to one flag from performing a read-modify-write that can overwrite concurrent changes to either of the other flags.