CVE-2026-90065: net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure

Published Sep 17, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

net/smc: release the internal TCP sock on IPPROTOSMC socket creation failure

IPPROTOSMC sockets create an internal TCP sock ("clcsock") from the proto->init hook. When socket creation fails after proto->init has run - e.g. a cgroup BPF program attached to BPFCGROUPINETSOCKCREATE denies the socket - skcommonrelease() only invokes skprot->destroy if it is set, but neither smcinetprot nor smcinet6prot defines it, and smcdestruct() returns early unless skstate is SMCCLOSED. As a result, every failing socket(AFINET, SOCKSTREAM, IPPROTOSMC) call leaks one tcpsock, so an unprivileged task able to attach a deny-all BPFCGROUPINETSOCKCREATE program to its own cgroup can grow kernel memory unboundedly.

Add a .destroy hook to both protos that releases the clcsock via smcclcsockrelease(). smcskinit() hashes the sock into the smc hashinfo before the clcsock is created, and smcdiag dumps walk that hash dereferencing smc->clcsock without taking clcsockreleaselock, while skcommonrelease() calls .destroy before .unhash. Unhash the sock before releasing the clcsock, as smcrelease() does, so a concurrent dump cannot observe the release; the second unhash in skcommonrelease() is a no-op.

Affected Software

1 affected component
Linux Kernel

Event History

Sep 17, 2026
CVE Published
via MITRE·04:05 PM
Data Sourced
via MITRE·04:05 PM
Description

Frequently Asked Questions

1

Who can trigger the memory leak?

An unprivileged task can trigger it if it is able to attach a deny-all BPF_CGROUP_INET_SOCK_CREATE program to its own cgroup. The program must deny creation after the SMC protocol initialization hook has run.

2

What is the impact of repeated exploitation?

Each failed socket(AF_INET, SOCK_STREAM, IPPROTO_SMC) call leaks one internal tcp_sock. Repeated calls can cause unbounded kernel-memory growth.

3

How can an affected system be identified?

The relevant failure pattern is repeated denied IPPROTO_SMC socket-creation attempts in a cgroup with a BPF_CGROUP_INET_SOCK_CREATE program attached. On vulnerable code, each such failed attempt leaves an internal TCP socket allocated.

4

What does the fix change?

The fix adds destroy hooks for the SMC IPv4 and IPv6 protocol handlers to release the internal TCP socket. It also unhashed the SMC socket before releasing that internal socket to avoid concurrent diagnostic traversal dereferencing it.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203