CVE-2026-23450

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()

Syzkaller reported a panic in smc_tcp_syn_recv_sock() [1].

smc_tcp_syn_recv_sock() is called in the TCP receive path

(softirq) via icsk_af_ops->syn_recv_sock on the clcsock (TCP

listening socket). It reads sk_user_data to get the smc_sock

pointer. However, when the SMC listen socket is being closed

concurrently, smc_close_active() sets clcsock->sk_user_data

to NULL under sk_callback_lock, and then the smc_sock itself

can be freed via sock_put() in smc_release().

This leads to two issues:

1) NULL pointer dereference: sk_user_data is NULL when

accessed.

2) Use-after-free: sk_user_data is read as non-NULL, but the

smc_sock is freed before its fields (e.g., queued_smc_hs,

ori_af_ops) are accessed.

The race window looks like this (the syzkaller crash [1]

triggers via the SYN cookie path: tcp_get_cookie_sock() ->

smc_tcp_syn_recv_sock(), but the

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References