UBUNTU-CVE-2026-80979: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: net/smc: unregister the connection before draining the rx tasklet smcconnfree() calls smcismunsetconn() only while the link group is still on its device list, and never sets conn->killed. smclgrterminatesched() unlinks the group immediately and defers killing its connections to a work item, so a connection freed in that window keeps its smcd->conn[] slot with both gates in smcdhandleirq() open, and the device can re-arm the receive tasklet after taskletkill() has returned. On the DMB-nocopy path the ghost send buffer is freed right after that drain, so the re-armed tasklet dereferences it. Unregister unconditionally and drain before the detach at both teardown sites, mirroring rmbdesc, which smcbufunuse() releases after the drain. Clear conn->sndbufdesc before freeing it as well, so a reader that samples the pointer cannot get one that is already freed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In net/smc connection teardown, unconditionally unregister the connection and drain the RX tasklet before detaching or freeing it at both teardown sites; clear conn->sndbuf_desc before freeing the send buffer.