PT-2026-51734 · Linux · Linux
Published
2026-06-24
·
Updated
2026-06-24
·
CVE-2026-52941
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
net/smc: avoid NULL deref of conn->lnk in smc msg event tracepoint
The smc msg event tracepoint class, shared by smc tx sendmsg and
smc rx recvmsg, unconditionally dereferences smc->conn.lnk:
string(name, smc->conn.lnk->ibname)conn->lnk is only set for SMC-R; for SMC-D it is NULL. Other code on
these paths already handles this (e.g. !conn->lnk in
SMC STAT RMB TX SIZE SMALL()). With the tracepoint enabled, the first
sendmsg()/recvmsg() on an SMC-D socket crashes:
Oops: general protection fault, probably for non-canonical address
KASAN: null-ptr-deref in range [...]
RIP: 0010:strlen+0x1e/0xa0
Call Trace:
trace event raw event smc msg event (net/smc/smc tracepoint.h:44)
smc rx recvmsg (net/smc/smc rx.c:515)
smc recvmsg (net/smc/af smc.c:2859)
sys recvfrom (net/socket.c:2315)
x64 sys recvfrom (net/socket.c:2326)
do syscall 64
The faulting address 0x3e0 is offsetof(struct smc link, ibname),
confirming the NULL ->lnk deref. Enabling the tracepoint requires
root, but the trigger itself is unprivileged: socket(AF SMC, ...) has
no capability check, and SMC-D negotiation needs no admin step on
s390 or on x86 with the loopback ISM device loaded.
Log an empty device name for SMC-D instead of dereferencing NULL.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux