CVE-2026-64541

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket

smc_cdc_rx_handler() looks up the connection by token under the link

group's conns_lock, drops the lock, and then dereferences conn and the

smc_sock derived from it, ending in sock_hold(&smc->sk) inside

smc_cdc_msg_recv(). No reference is held across the lock release.

The only reference pinning the socket while the connection is

discoverable in the link group is taken in smc_lgr_register_conn()

(sock_hold) and dropped in __smc_lgr_unregister_conn() (sock_put), both

under conns_lock. Once the handler drops conns_lock, a concurrent

close() -> smc_release() -> smc_conn_free() -> smc_lgr_unregister_conn()

can drop that reference and free the smc_sock, so the handler's later

sock_hold() runs on freed memory:

WARNING: lib/refcount.c:25 at refcount_warn_saturate

Workqueue: rxe_wq do_work

refcount_warn_saturate (lib/refcount.c:25)

smc_cdc_msg_recv (ne

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References