UBUNTU-CVE-2026-64048: Ubuntu/linux-hwe-edge vulnerability

In the Linux kernel, the following vulnerability has been resolved: net/smc: reject CHID-0 ACCEPT that matches an empty ismdev slot On the SMC-D client, slot 0 of ini->ismdev[]/ini->ismchid[] is reserved for an SMC-Dv1 device. smcfindismv2deviceclnt() populates V2 entries starting at index 1, so when no V1 device is selected slot 0 is left in its kzalloc()'ed state with ismdev[0] == NULL and ismchid[0] == 0. smcv2determineacceptedchid() then matches the peer's CHID against the array starting from index 0 using the CHID alone. A malicious peer replying to a SMC-Dv2-only proposal with d1.chid == 0 matches the empty slot, ini->ismselected becomes 0, and the subsequent ismdev[0]->lgrlock dereference in smcconncreate() faults at offsetof(struct smcddev, lgrlock) == 0x68: BUG: KASAN: null-ptr-deref in rawspinlockbh+0x79/0xe0 Write of size 4 at addr 0000000000000068 by task exploit/144 Call Trace: rawspinlockbh smcconncreate (net/smc/smccore.c:1997) smcconnect (net/smc/afsmc.c:1447) smcconnect (net/smc/afsmc.c:1720) sysconnect x64sysconnect dosyscall64 Require ismdev[i] to be non-NULL before accepting a CHID match.