CVE-2026-80982

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/smc: fix use-after-free in smc_rx_pipe_buf_release()

smc_rx_splice() hands RMB pages to a pipe and takes a socket reference

per entry so the smc_sock stays alive until the reader finishes. The

connection does not: a concurrent close runs smc_conn_free(), which

releases the receive buffer back to the link group pool.

smc_rx_pipe_buf_release() tests sk_state before taking the socket lock.

The state can change between the test and the lock, and

smc_rx_update_cons() then dereferences conn->rmb_desc and walks

conn->lgr, which smc_conn_free() has already released. On the

is_reg_err path smcr_buf_unuse() frees the descriptor outright, so

this is a use-after-free.

Take the socket lock first and test conn->freed instead.

smc_conn_free() sets that flag before releasing anything, and every

caller holds the socket lock. The two paths exclude each other: either

the pipe release runs first with everything valid, or it sees t

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References