UBUNTU-CVE-2026-80982: Use After Free
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free in smcrxpipebufrelease() smcrxsplice() hands RMB pages to a pipe and takes a socket reference per entry so the smcsock stays alive until the reader finishes. The connection does not: a concurrent close runs smcconnfree(), which releases the receive buffer back to the link group pool. smcrxpipebufrelease() tests skstate before taking the socket lock. The state can change between the test and the lock, and smcrxupdatecons() then dereferences conn->rmbdesc and walks conn->lgr, which smcconnfree() has already released. On the isregerr path smcrbufunuse() frees the descriptor outright, so this is a use-after-free. Take the socket lock first and test conn->freed instead. smcconnfree() sets that flag before releasing anything, and every caller holds the socket lock. The two paths exclude each other: either the pipe release runs first with everything valid, or it sees the flag and skips the update.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What conditions are required to trigger this issue?
The affected path requires SMC receive data to be handed to a pipe through smc_rx_splice(), followed by pipe-buffer release while the SMC connection is concurrently closed. Exploitation requires local access and low privileges; no user interaction is required.
Which Ubuntu kernel packages are listed as affected?
The listed software includes ubuntu/linux, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-aws-fips, ubuntu/linux-azure-fips, ubuntu/linux-fips, ubuntu/linux-gcp-fips, and ubuntu/linux-realtime.
What is the impact of a successful race?
A concurrent connection close can free the receive-buffer descriptor and link-group resources before pipe-buffer release updates the receive consumer state. The release path can then dereference freed connection data, resulting in a use-after-free with high impact to confidentiality, integrity, and availability.
What does the fix change?
The fix takes the socket lock before checking connection state and checks the connection's freed flag. Because connection teardown sets that flag while holding the same lock before releasing resources, the pipe-release path either updates still-valid data or skips the update.