PT-2026-65216 · Linux · Linux
CVE-2026-64541
·
Publicado
2026-07-27
·
Atualizado
2026-07-27
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
net/smc: fix UAF in smc cdc rx handler() by pinning the socket
smc cdc rx handler() looks up the connection by token under the link
group's conns lock, drops the lock, and then dereferences conn and the
smc sock derived from it, ending in sock hold(&smc->sk) inside
smc cdc msg recv(). No reference is held across the lock release.
The only reference pinning the socket while the connection is
discoverable in the link group is taken in smc lgr register conn()
(sock hold) and dropped in smc lgr unregister conn() (sock put), both
under conns lock. Once the handler drops conns lock, a concurrent
close() -> smc release() -> smc conn free() -> smc lgr unregister conn()
can drop that reference and free the smc sock, so the handler's later
sock hold() runs on freed memory:
WARNING: lib/refcount.c:25 at refcount warn saturate
Workqueue: rxe wq do work
refcount warn saturate (lib/refcount.c:25)
smc cdc msg recv (net/smc/smc cdc.c:430)
smc cdc rx handler (net/smc/smc cdc.c:502)
smc wr rx tasklet fn (net/smc/smc wr.c:445)
tasklet action common (kernel/softirq.c:938)
handle softirqs (kernel/softirq.c:622)
Kernel panic - not syncing: panic on warn set
Only SMC-R is affected. The SMC-D receive tasklet is stopped by
tasklet kill(&conn->rx tsklet) in smc conn free() before the connection
is unregistered, so it cannot run concurrently with the free.
Take the socket reference while still holding conns lock, so the
registration reference can no longer be the last one, and drop it once
the handler is done.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux