CVE-2026-74719

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()

The SMC_LLC_CONFIRM_LINK / SMC_LLC_ADD_LINK_CONT branch in

smc_llc_event_handler() stores an incoming qentry into the local LLC flow

without first checking whether a qentry is already pending. If a malicious or

buggy peer sends a second CONFIRM_LINK or ADD_LINK_CONT request while a flow is

active and flow->qentry is already set, smc_llc_flow_qentry_set() overwrites the

pointer without freeing the previous allocation, leaking one kmalloc-96 object

per spurious message.

The sibling SMC_LLC_DELETE_LINK branch already has the correct !flow->qentry

guard. Apply the same guard to the CONFIRM_LINK/ADD_LINK_CONT branch so that a

duplicate message when qentry is already occupied falls through to break and is

freed by the kfree(qentry) at the out: label, rather than silently leaking the

existing allocation.

The response direction (smc

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References