REDHAT-BUG-2502589: Medium severity Linux Kernel vulnerability

Published Jul 19, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

net/smc: reject CHID-0 ACCEPT that matches an empty ismdev slot

On the SMC-D client, slot 0 of ini->ismdev[]/ini->ismchid[] is reserved for an SMC-Dv1 device. smcfindismv2deviceclnt() populates V2 entries starting at index 1, so when no V1 device is selected slot 0 is left in its kzalloc()'ed state with ismdev[0] == NULL and ismchid[0] == 0.

smcv2determineacceptedchid() then matches the peer's CHID against the array starting from index 0 using the CHID alone. A malicious peer replying to a SMC-Dv2-only proposal with d1.chid == 0 matches the empty slot, ini->ismselected becomes 0, and the subsequent ismdev[0]->lgrlock dereference in smcconncreate() faults at offsetof(struct smcddev, lgrlock) == 0x68:

BUG: KASAN: null-ptr-deref in rawspinlockbh+0x79/0xe0 Write of size 4 at addr 0000000000000068 by task exploit/144 Call Trace: rawspinlockbh smcconncreate (net/smc/smccore.c:1997) smcconnect (net/smc/afsmc.c:1447) smcconnect (net/smc/afsmc.c:1720) sysconnect x64sysconnect dosyscall64

Require ismdev[i] to be non-NULL before accepting a CHID match.

Affected Software

1 affected component

Linux Kernel

Event History

Jul 19, 2026

Data Sourced

via Red Hat·05:07 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What conditions are required for exploitation?

The vulnerable system must act as an SMC-D client using an SMC-Dv2-only proposal with no selected SMC-Dv1 device, leaving the reserved device slot empty. A malicious peer must then reply with a CHID value of 0, causing that empty slot to be selected.

What is the practical impact of a successful attack?

The crafted CHID response can cause a NULL-pointer dereference when the kernel accesses the selected SMC device's lgr_lock. The described result is a kernel fault during connection creation, which can cause a denial of service.

How can administrators identify the affected connection scenario?

The relevant scenario is an SMC-D client whose SMC-Dv2 device entries begin at index 1 while slot 0 remains NULL with CHID 0. Kernel crash reports may show a NULL-pointer dereference at address 0x68 in _raw_spin_lock_bh, with smc_conn_create and smc_connect in the call trace.

REDHAT-BUG-2502589: Medium severity Linux Kernel vulnerability

Affected Software

Event History

Frequently Asked Questions

What conditions are required for exploitation?

What is the practical impact of a successful attack?

How can administrators identify the affected connection scenario?

Company

Resources

Contact

Frequently Asked Questions

What conditions are required for exploitation?

What is the practical impact of a successful attack?

How can administrators identify the affected connection scenario?