GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80979 (GCVE-0-2026-80979)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:42 – Updated: 2026-09-14 11:59
VLAI
Title
net/smc: unregister the connection before draining the rx tasklet
Summary
In the Linux kernel, the following vulnerability has been resolved: net/smc: unregister the connection before draining the rx tasklet smc_conn_free() calls smc_ism_unset_conn() only while the link group is still on its device list, and never sets conn->killed. smc_lgr_terminate_sched() unlinks the group immediately and defers killing its connections to a work item, so a connection freed in that window keeps its smcd->conn[] slot with both gates in smcd_handle_irq() open, and the device can re-arm the receive tasklet after tasklet_kill() has returned. On the DMB-nocopy path the ghost send buffer is freed right after that drain, so the re-armed tasklet dereferences it. Unregister unconditionally and drain before the detach at both teardown sites, mirroring rmb_desc, which smc_buf_unuse() releases after the drain. Clear conn->sndbuf_desc before freeing it as well, so a reader that samples the pointer cannot get one that is already freed.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 21f6f41e82e59740e26e06e77bdf58dc7f6f08dd , < b6b6ac713ee82b340a8e3be30b101bd2840deec4 (git)
Affected: ae2be35cbed2c8385e890147ea321a3fcc3ca5fa , < b4d540ac95cd35c6ebab6afb7eae2bcac7b277a5 (git)
Affected: ae2be35cbed2c8385e890147ea321a3fcc3ca5fa , < 5bd8b764a610b6b6bc0c4d3d01652747f6e0b5c3 (git)
Affected: ae2be35cbed2c8385e890147ea321a3fcc3ca5fa , < b74d313567dfc1b7e56629ddbad04e728686f235 (git)
Affected: ae2be35cbed2c8385e890147ea321a3fcc3ca5fa , < 36cdf5d48ca191dcd71c28cadbe0981b1d25318d (git)
Affected: 6.6.66 , < 6.6.157 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.10
Unaffected: 0 , < 6.10 (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/smc/smc_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b6b6ac713ee82b340a8e3be30b101bd2840deec4",
              "status": "affected",
              "version": "21f6f41e82e59740e26e06e77bdf58dc7f6f08dd",
              "versionType": "git"
            },
            {
              "lessThan": "b4d540ac95cd35c6ebab6afb7eae2bcac7b277a5",
              "status": "affected",
              "version": "ae2be35cbed2c8385e890147ea321a3fcc3ca5fa",
              "versionType": "git"
            },
            {
              "lessThan": "5bd8b764a610b6b6bc0c4d3d01652747f6e0b5c3",
              "status": "affected",
              "version": "ae2be35cbed2c8385e890147ea321a3fcc3ca5fa",
              "versionType": "git"
            },
            {
              "lessThan": "b74d313567dfc1b7e56629ddbad04e728686f235",
              "status": "affected",
              "version": "ae2be35cbed2c8385e890147ea321a3fcc3ca5fa",
              "versionType": "git"
            },
            {
              "lessThan": "36cdf5d48ca191dcd71c28cadbe0981b1d25318d",
              "status": "affected",
              "version": "ae2be35cbed2c8385e890147ea321a3fcc3ca5fa",
              "versionType": "git"
            },
            {
              "lessThan": "6.6.157",
              "status": "affected",
              "version": "6.6.66",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/smc/smc_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "6.6.66",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: unregister the connection before draining the rx tasklet\n\nsmc_conn_free() calls smc_ism_unset_conn() only while the link group is\nstill on its device list, and never sets conn-\u003ekilled.\nsmc_lgr_terminate_sched() unlinks the group immediately and defers killing\nits connections to a work item, so a connection freed in that window keeps\nits smcd-\u003econn[] slot with both gates in smcd_handle_irq() open, and the\ndevice can re-arm the receive tasklet after tasklet_kill() has returned. On\nthe DMB-nocopy path the ghost send buffer is freed right after that drain,\nso the re-armed tasklet dereferences it.\n\nUnregister unconditionally and drain before the detach at both teardown\nsites, mirroring rmb_desc, which smc_buf_unuse() releases after the drain.\nClear conn-\u003esndbuf_desc before freeing it as well, so a reader that samples\nthe pointer cannot get one that is already freed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is on the SMC-D DMB-nocopy teardown path, which only loopback-ISM implements; that device accepts a peer only when the GID matches this host, so a local AF_SMC/IPPROTO_SMC pair reaches smc_conn_free()/smcd_handle_irq(), and a remote TCP/CLC peer cannot attach to that fabric.\nAC:L - The attacker owns both sockets and can send on one endpoint to arm smcd_handle_irq() while close() on the other runs smc_conn_free()/smc_conn_kill, which kfree sndbuf_desc before tasklet_kill; they control both sides of the race, so complexity is Low.\nPR:L - socket(AF_SMC) and IPPROTO_SMC listen/connect on ephemeral ports need no capabilities, and loopback-ISM is usable from a user network namespace, so only an unprivileged local account is required.\nUI:N - The attacker performs connect, send, and close on their own SMC sockets; no separate victim action such as mounting a filesystem or opening a file is required.\nS:U - The freed object is a kernel kmalloc smc_buf_desc processed by a tasklet in the same kernel; this is privilege escalation within one security authority, not a VM, IOMMU, or sandbox escape.\nC:H - smcd_cdc_rx_tsklet/smc_cdc_msg_recv_action dereference the freed ghost sndbuf_desc (including -\u003elen); a slab use-after-free of a kmalloc object that the attacker can spray yields an arbitrary kernel read.\nI:H - The same tasklet continues into cursor updates and smc_tx_pending() which write through the recycled descriptor, so heap spraying the use-after-free provides an arbitrary kernel write and control-flow hijack primitive.\nA:H - Tasklet use of the freed smc_buf_desc oopses or panics the kernel even without a full exploit, causing a full system availability loss that the attacker can repeat."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T11:59:24.610Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b6b6ac713ee82b340a8e3be30b101bd2840deec4"
        },
        {
          "url": "https://git.kernel.org/stable/c/b4d540ac95cd35c6ebab6afb7eae2bcac7b277a5"
        },
        {
          "url": "https://git.kernel.org/stable/c/5bd8b764a610b6b6bc0c4d3d01652747f6e0b5c3"
        },
        {
          "url": "https://git.kernel.org/stable/c/b74d313567dfc1b7e56629ddbad04e728686f235"
        },
        {
          "url": "https://git.kernel.org/stable/c/36cdf5d48ca191dcd71c28cadbe0981b1d25318d"
        }
      ],
      "title": "net/smc: unregister the connection before draining the rx tasklet",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80979",
    "datePublished": "2026-09-11T19:42:40.171Z",
    "dateReserved": "2026-08-26T14:34:25.811Z",
    "dateUpdated": "2026-09-14T11:59:24.610Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80979",
      "date": "2026-09-18",
      "epss": "0.00128",
      "percentile": "0.02857"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-14T14:47:22.000Z",
      "cve": "CVE-2026-80979",
      "id": "msrc_CVE-2026-80979",
      "initial_release_date": "2026-09-13T01:02:03.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net/smc: unregister the connection before draining the rx tasklet",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-80979.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/smc/smc_core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "b6b6ac713ee82b340a8e3be30b101bd2840deec4",
                    "status": "affected",
                    "version": "21f6f41e82e59740e26e06e77bdf58dc7f6f08dd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b4d540ac95cd35c6ebab6afb7eae2bcac7b277a5",
                    "status": "affected",
                    "version": "ae2be35cbed2c8385e890147ea321a3fcc3ca5fa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5bd8b764a610b6b6bc0c4d3d01652747f6e0b5c3",
                    "status": "affected",
                    "version": "ae2be35cbed2c8385e890147ea321a3fcc3ca5fa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b74d313567dfc1b7e56629ddbad04e728686f235",
                    "status": "affected",
                    "version": "ae2be35cbed2c8385e890147ea321a3fcc3ca5fa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "36cdf5d48ca191dcd71c28cadbe0981b1d25318d",
                    "status": "affected",
                    "version": "ae2be35cbed2c8385e890147ea321a3fcc3ca5fa",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "6.6.157",
                    "status": "affected",
                    "version": "6.6.66",
                    "versionType": "semver"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/smc/smc_core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.10"
                  },
                  {
                    "lessThan": "6.10",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.157",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.109",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.50",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: unregister the connection before draining the rx tasklet\n\nsmc_conn_free() calls smc_ism_unset_conn() only while the link group is\nstill on its device list, and never sets conn-\u003ekilled.\nsmc_lgr_terminate_sched() unlinks the group immediately and defers killing\nits connections to a work item, so a connection freed in that window keeps\nits smcd-\u003econn[] slot with both gates in smcd_handle_irq() open, and the\ndevice can re-arm the receive tasklet after tasklet_kill() has returned. On\nthe DMB-nocopy path the ghost send buffer is freed right after that drain,\nso the re-armed tasklet dereferences it.\n\nUnregister unconditionally and drain before the detach at both teardown\nsites, mirroring rmb_desc, which smc_buf_unuse() releases after the drain.\nClear conn-\u003esndbuf_desc before freeing it as well, so a reader that samples\nthe pointer cannot get one that is already freed."
          }
        ],
        "id": "CVE-2026-80979",
        "lastModified": "2026-09-14T13:18:52.803",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-11T20:19:04.277",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/36cdf5d48ca191dcd71c28cadbe0981b1d25318d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5bd8b764a610b6b6bc0c4d3d01652747f6e0b5c3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b4d540ac95cd35c6ebab6afb7eae2bcac7b277a5"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b6b6ac713ee82b340a8e3be30b101bd2840deec4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b74d313567dfc1b7e56629ddbad04e728686f235"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T19:08:31+00:00",
      "cve": "CVE-2026-80979",
      "id": "CVE-2026-80979",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "185",
      "product_status:known_not_affected": "91",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/smc: unregister the connection before draining the rx tasklet",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80979.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T01:04:53Z",
      "cve": "CVE-2026-80979",
      "id": "CVE-2026-80979",
      "initial_release_date": "2026-09-12T16:36:22Z",
      "product_status:known_affected": "69",
      "product_status:known_not_affected": "284",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80979",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80979.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.