CVE-2026-90065

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure

IPPROTO_SMC sockets create an internal TCP sock ("clcsock") from the

proto->init hook. When socket creation fails after proto->init has

run - e.g. a cgroup BPF program attached to BPF_CGROUP_INET_SOCK_CREATE

denies the socket - sk_common_release() only invokes sk_prot->destroy

if it is set, but neither smc_inet_prot nor smc_inet6_prot defines it,

and smc_destruct() returns early unless sk_state is SMC_CLOSED. As a

result, every failing socket(AF_INET, SOCK_STREAM, IPPROTO_SMC) call

leaks one tcp_sock, so an unprivileged task able to attach a deny-all

BPF_CGROUP_INET_SOCK_CREATE program to its own cgroup can grow kernel

memory unboundedly.

Add a .destroy hook to both protos that releases the clcsock via

smc_clcsock_release(). smc_sk_init() hashes the sock into the smc

hashinfo before the clcsock is created, and smc_diag dumps walk that

hash

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References