In the Linux kernel, the following vulnerability has been resolved:
net/smc: fix UAF on smcsk after smc_listen_out()
BPF CI testing report a UAF issue:
[ 16.446633] BUG: kernel NULL pointer dereference, address: 000000000000003 0 [ 16.447134] #PF: supervisor read access in kernel mod e [ 16.447516] #PF: error_code(0x0000) - not-present pag e [ 16.447878] PGD 0 P4D 0 [ 16.448063] Oops: Oops: 0000 [#1] PREEMPT SMP NOPT I [ 16.448409] CPU: 0 UID: 0 PID: 9 Comm: kworker/0:1 Tainted: G OE 6.13.0-rc3-g89e8a75fda73-dirty #4 2 [ 16.449124] Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODUL E [ 16.449502] Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/201 4 [ 16.450201] Workqueue: smc_hs_wq smc_listen_wor k [ 16.450531] RIP: 0010:smc_listen_work+0xc02/0x159 0 [ 16.452158] RSP: 0018:ffffb5ab40053d98 EFLAGS: 0001024 6 [ 16.452526] RAX: 0000000000000001 RBX: 0000000000000002 RCX: 000000000000030 0 [ 16.452994] RDX: 0000000000000280 RSI: 00003513840053f0 RDI: 000000000000000 0 [ 16.453492] RBP: ffffa097808e3800 R08: ffffa09782dba1e0 R09: 000000000000000 5 [ 16.453987] R10: 0000000000000000 R11: 0000000000000000 R12: ffffa0978274640 0 [ 16.454497] R13: 0000000000000000 R14: 0000000000000000 R15: ffffa09782d4092 0 [ 16.454996] FS: 0000000000000000(0000) GS:ffffa097bbc00000(0000) knlGS:000000000000000 0 [ 16.455557] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003 3 [ 16.455961] CR2: 0000000000000030 CR3: 0000000102788004 CR4: 0000000000770ef 0 [ 16.456459] PKRU: 5555555 4 [ 16.456654] Call Trace : [ 16.456832] <TASK > [ 16.456989] ? __die+0x23/0x7 0 [ 16.457215] ? page_fault_oops+0x180/0x4c 0 [ 16.457508] ? __lock_acquire+0x3e6/0x249 0 [ 16.457801] ? exc_page_fault+0x68/0x20 0 [ 16.458080] ? asm_exc_page_fault+0x26/0x3 0 [ 16.458389] ? smc_listen_work+0xc02/0x159 0 [ 16.458689] ? smc_listen_work+0xc02/0x159 0 [ 16.458987] ? lock_is_held_type+0x8f/0x10 0 [ 16.459284] process_one_work+0x1ea/0x6d 0 [ 16.459570] worker_thread+0x1c3/0x38 0 [ 16.459839] ? __pfx_worker_thread+0x10/0x1 0 [ 16.460144] kthread+0xe0/0x11 0 [ 16.460372] ? __pfx_kthread+0x10/0x1 0 [ 16.460640] ret_from_fork+0x31/0x5 0 [ 16.460896] ? __pfx_kthread+0x10/0x1 0 [ 16.461166] ret_from_fork_asm+0x1a/0x3 0 [ 16.461453] </TASK > [ 16.461616] Modules linked in: bpf_testmod(OE) [last unloaded: bpf_testmod(OE) ] [ 16.462134] CR2: 000000000000003 0 [ 16.462380] ---[ end trace 0000000000000000 ]--- [ 16.462710] RIP: 0010:smc_listen_work+0xc02/0x1590
The direct cause of this issue is that after smc_listen_out_connected(), newclcsock->sk may be NULL since it will releases the smcsk. Therefore, if the application closes the socket immediately after accept, newclcsock->sk can be NULL. A possible execution order could be as follows:
smc_listen_work | userspace ----------------------------------------------------------------- lock_sock(sk) | smc_listen_out_connected() | | \- smc_listen_out | | | \- release_sock | | |- sk->sk_data_ready() | | fd = accept(); | close(fd); | \- socket->sk = NULL; /* newclcsock->sk is NULL now */ SMC_STAT_SERV_SUCC_INC(sock_net(newclcsock->sk))
Since smc_listen_out_connected() will not fail, simply swapping the order of the code can easily fix this issue.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 23, 2026 | Jul 23, 2026 |
| Suse | — | Upgrade kernel-azure-extraUpgrade kernel-symsUpgrade kernel-source-azureUpgrade kernel-default-baseUpgrade dtb-caviumUpgrade kernel-default-develUpgrade kernel-default-optionalUpgrade dtb-amdUpgrade dtb-appleUpgrade dtb-armUpgrade ocfs2-kmp-rtUpgrade dtb-lgUpgrade kernel-azure-optionalUpgrade kernel-defaultUpgrade reiserfs-kmp-rtUpgrade dtb-alteraUpgrade kernel-debugUpgrade kernel-docsUpgrade kernel-64kb-develUpgrade kernel-rt_debugUpgrade reiserfs-kmp-defaultUpgrade dlm-kmp-defaultUpgrade dtb-renesasUpgrade gfs2-kmp-azureUpgrade dtb-allwinnerUpgrade kernel-zfcpdumpUpgrade kernel-default-livepatch-develUpgrade ocfs2-kmp-azureUpgrade kernel-debug-develUpgrade ocfs2-kmp-defaultUpgrade gfs2-kmp-defaultUpgrade dtb-marvellUpgrade kernel-kvmsmall-develUpgrade cluster-md-kmp-azureUpgrade dtb-mediatekUpgrade dlm-kmp-rtUpgrade dtb-hisiliconUpgrade kernel-devel-rtUpgrade dtb-amazonUpgrade dtb-xilinxUpgrade cluster-md-kmp-rtUpgrade dtb-apmUpgrade kselftests-kmp-rtUpgrade gfs2-kmp-64kbUpgrade kernel-develUpgrade kernel-rt-livepatchUpgrade kernel-default-livepatchUpgrade kernel-rt-develUpgrade kernel-64kb-optionalUpgrade dtb-socionextUpgrade dtb-freescaleUpgrade kernel-64kbUpgrade kernel-64kb-extraUpgrade kernel-syms-azureUpgrade gfs2-kmp-rtUpgrade cluster-md-kmp-defaultUpgrade kernel-rtUpgrade kernel-azureUpgrade reiserfs-kmp-azureUpgrade dtb-amlogicUpgrade kernel-sourceUpgrade kernel-rt_debug-vdsoUpgrade kernel-obs-buildUpgrade kernel-default-extraUpgrade dtb-exynosUpgrade kernel-source-vanillaUpgrade dtb-rockchipUpgrade kernel-syms-rtUpgrade kernel-kvmsmall-vdsoUpgrade kernel-default-vdsoUpgrade dlm-kmp-azureUpgrade kselftests-kmp-defaultUpgrade kernel-docs-htmlUpgrade dtb-qcomUpgrade ocfs2-kmp-64kbUpgrade kselftests-kmp-64kbUpgrade kernel-rt_debug-develUpgrade kernel-rt-extraUpgrade kernel-macrosUpgrade kernel-rt-vdsoUpgrade reiserfs-kmp-64kbUpgrade kselftests-kmp-azureUpgrade dtb-broadcomUpgrade kernel-devel-azureUpgrade kernel-debug-vdsoUpgrade cluster-md-kmp-64kbUpgrade kernel-source-rtUpgrade kernel-azure-develUpgrade kernel-default-base-rebuildUpgrade kernel-azure-vdsoUpgrade dtb-sprdUpgrade kernel-kvmsmallUpgrade dlm-kmp-64kbUpgrade kernel-rt-optionalUpgrade kernel-rt-livepatch-develUpgrade kernel-obs-qaUpgrade dtb-nvidia | Dec 5, 2025 | Oct 15, 2025 |
| Ubuntu | — | Upgrade linux-image-6.8.0-1047-gcpUpgrade linux-image-azureUpgrade linux-image-aws-64k-6.8Upgrade linux-image-fips-6.8Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-aws-fips-6.8Upgrade linux-image-6.8.0-1030-gkeopUpgrade linux-image-6.8.0-1046-nvidiaUpgrade linux-image-azure-fipsUpgrade linux-image-6.8.0-1043-oracle-64kUpgrade linux-image-virtual-6.8Upgrade linux-image-raspi-realtimeUpgrade linux-image-oem-22.04bUpgrade linux-image-gcp-64kUpgrade linux-image-6.8.0-1046-awsUpgrade linux-image-raspi-6.8Upgrade linux-image-6.8.0-1046-aws-fipsUpgrade linux-image-generic-64k-6.8Upgrade linux-image-oracleUpgrade linux-image-azure-fips-6.8Upgrade linux-image-aws-lts-24.04Upgrade linux-image-awsUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-gkeUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-6.8.0-1044-ibmUpgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-realtime-hwe-22.04Upgrade linux-image-xilinxUpgrade linux-image-realtime-6.8.1Upgrade linux-image-aws-64kUpgrade linux-image-nvidia-64kUpgrade linux-image-nvidia-6.8Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-6.8.0-1047-gcp-fipsUpgrade linux-image-raspiUpgrade linux-image-6.8.0-2037-raspi-realtimeUpgrade linux-image-6.8.0-1046-azure-fipsUpgrade linux-image-gke-64k-6.8Upgrade linux-image-6.8.0-1047-raspiUpgrade linux-image-6.8.1-1041-realtimeUpgrade linux-image-oem-22.04dUpgrade linux-image-6.8.0-1043-gke-64kUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-gke-64kUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-gke-6.8Upgrade linux-image-gcp-6.8Upgrade linux-image-gcpUpgrade linux-image-kvmUpgrade linux-image-oracle-6.8Upgrade linux-image-oracle-64kUpgrade linux-image-xilinx-6.8Upgrade linux-image-realtimeUpgrade linux-image-6.8.0-100-lowlatencyUpgrade linux-image-gcp-64k-6.8Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-100-lowlatency-64kUpgrade linux-image-6.8.0-100-fipsUpgrade linux-image-virtualUpgrade linux-image-6.8.0-100-generic-64kUpgrade linux-image-gcp-fips-6.8Upgrade linux-image-6.8.0-1043-gkeUpgrade linux-image-xilinx-zynqmpUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-oracle-lts-24.04Upgrade linux-image-gcp-fipsUpgrade linux-image-6.8.0-1046-nvidia-lowlatency-64kUpgrade linux-image-nvidia-64k-6.8Upgrade linux-image-nvidiaUpgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1051-azureUpgrade linux-image-intel-iotgUpgrade linux-image-6.8.0-1043-oracleUpgrade linux-image-ibm-6.8Upgrade linux-image-6.8.0-100-genericUpgrade linux-image-azure-6.8Upgrade linux-image-6.8.0-1046-nvidia-lowlatencyUpgrade linux-image-raspi-realtime-6.8Upgrade linux-image-ibmUpgrade linux-image-gkeop-6.8Upgrade linux-image-6.8.0-1046-nvidia-64kUpgrade linux-image-6.8.0-1046-aws-64kUpgrade linux-image-6.8.0-1023-xilinxUpgrade linux-image-generic-64kUpgrade linux-image-genericUpgrade linux-image-6.8.0-1047-gcp-64kUpgrade linux-image-oracle-64k-6.8Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-lowlatency-6.8Upgrade linux-image-azure-lts-24.04Upgrade linux-image-oem-22.04cUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-1046-azureUpgrade linux-image-aws-fipsUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-aws-6.8Upgrade linux-image-generic-lpaeUpgrade linux-image-oem-22.04aUpgrade linux-image-gkeopUpgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-fipsUpgrade linux-image-oem-22.04Upgrade linux-image-generic-6.8Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-lowlatency-64kUpgrade linux-image-lowlatency | Feb 12, 2026 | Sep 5, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub