CVE-2026-98559: net/smc: fix UAF on lgr list traversal in smcr_port_err()
Published Oct 18, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
net/smc: fix UAF on lgr list traversal in smcrporterr()
smcrporterr() traverses smclgrlist.list without holding smclgrlist.lock, allowing a concurrent smclgrterminatesched() to free an lgr while it is still being dereferenced.
Hold smclgrlist.lock across the traversal. Update smcibgidcheck() to call smcrporterr() after releasing the lock.
Affected Software
1 affected component
Linux Linux kernel
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Hold smc_lgr_list.lock across the smcr_port_err() traversal so concurrent smc_lgr_terminate_sched() cannot free an lgr while it is being dereferenced; ensure smc_ib_gid_check() calls smcr_port_err() only after releasing the lock.
Event History
Oct 18, 2026
CVE Published
via MITRE·03:18 PM
Data Sourced
via MITRE·03:18 PM
Description
Data Sourced
via NVD·04:17 PM
Description