CVE-2026-90065: net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure
In the Linux kernel, the following vulnerability has been resolved:
net/smc: release the internal TCP sock on IPPROTOSMC socket creation failure
IPPROTOSMC sockets create an internal TCP sock ("clcsock") from the proto->init hook. When socket creation fails after proto->init has run - e.g. a cgroup BPF program attached to BPFCGROUPINETSOCKCREATE denies the socket - skcommonrelease() only invokes skprot->destroy if it is set, but neither smcinetprot nor smcinet6prot defines it, and smcdestruct() returns early unless skstate is SMCCLOSED. As a result, every failing socket(AFINET, SOCKSTREAM, IPPROTOSMC) call leaks one tcpsock, so an unprivileged task able to attach a deny-all BPFCGROUPINETSOCKCREATE program to its own cgroup can grow kernel memory unboundedly.
Add a .destroy hook to both protos that releases the clcsock via smcclcsockrelease(). smcskinit() hashes the sock into the smc hashinfo before the clcsock is created, and smcdiag dumps walk that hash dereferencing smc->clcsock without taking clcsockreleaselock, while skcommonrelease() calls .destroy before .unhash. Unhash the sock before releasing the clcsock, as smcrelease() does, so a concurrent dump cannot observe the release; the second unhash in skcommonrelease() is a no-op.
Affected Software
Event History
Frequently Asked Questions
Who can trigger the memory leak?
An unprivileged task can trigger it if it is able to attach a deny-all BPF_CGROUP_INET_SOCK_CREATE program to its own cgroup. The program must deny creation after the SMC protocol initialization hook has run.
What is the impact of repeated exploitation?
Each failed socket(AF_INET, SOCK_STREAM, IPPROTO_SMC) call leaks one internal tcp_sock. Repeated calls can cause unbounded kernel-memory growth.
How can an affected system be identified?
The relevant failure pattern is repeated denied IPPROTO_SMC socket-creation attempts in a cgroup with a BPF_CGROUP_INET_SOCK_CREATE program attached. On vulnerable code, each such failed attempt leaves an internal TCP socket allocated.
What does the fix change?
The fix adds destroy hooks for the SMC IPv4 and IPv6 protocol handlers to release the internal TCP socket. It also unhashed the SMC socket before releasing that internal socket to avoid concurrent diagnostic traversal dereferencing it.