CVE-2026-80980

CVE-2026-80980 is a race condition in the Linux kernel's SMC (Server Message Block over Remote Direct Memory Access) protocol. Three single-bit flags (killed, freed, out_of_sync) in struct smc_connection share a single byte and are written from concurrent contexts—smc_cdc_msg_validate() from a re...

EUVD-2026-76303

In the Linux kernel, the following vulnerability has been resolved: net/smc: stop killed, freed and outofsync sharing a byte The three connection state flags are single-bit bitfields, so they occupy one byte of struct smcconnection and every store to one is a read-modify-write of the other two: u...

CVE-2026-80980 net/smc: stop killed, freed and out_of_sync sharing a byte

In the Linux kernel, the following vulnerability has been resolved: net/smc: stop killed, freed and outofsync sharing a byte The three connection state flags are single-bit bitfields, so they occupy one byte of struct smcconnection and every store to one is a read-modify-write of the other two: u...

CVE-2026-80979

CVE-2026-80979 is a use-after-free in the Linux kernel's Shared Memory Communications (SMC) component (net/smc). During connection termination, a race between smc_conn_free() and smc_lgr_terminate_sched() allows the device to re-arm the receive tasklet after tasklet_kill() returns. On the DMB-noc...

CVE-2026-80979 net/smc: unregister the connection before draining the rx tasklet

In the Linux kernel, the following vulnerability has been resolved: net/smc: unregister the connection before draining the rx tasklet smcconnfree calls smcismunsetconn only while the link group is still on its device list, and never sets conn-killed. smclgrterminatesched unlinks the group...

EUVD-2026-76302

In the Linux kernel, the following vulnerability has been resolved: net/smc: unregister the connection before draining the rx tasklet smcconnfree calls smcismunsetconn only while the link group is still on its device list, and never sets conn-killed. smclgrterminatesched unlinks the group...

CVE-2026-80980 net/smc: stop killed, freed and out_of_sync sharing a byte

In the Linux kernel, the following vulnerability has been resolved: net/smc: stop killed, freed and outofsync sharing a byte The three connection state flags are single-bit bitfields, so they occupy one byte of struct smcconnection and every store to one is a read-modify-write of the other two: u...

CVE-2026-80980 net/smc: stop killed, freed and out_of_sync sharing a byte

In the Linux kernel, the following vulnerability has been resolved: net/smc: stop killed, freed and outofsync sharing a byte The three connection state flags are single-bit bitfields, so they occupy one byte of struct smcconnection and every store to one is a read-modify-write of the other two: u...

CVE-2026-80979

In the Linux kernel, the following vulnerability has been resolved: net/smc: unregister the connection before draining the rx tasklet smcconnfree calls smcismunsetconn only while the link group is still on its device list, and never sets conn-killed. smclgrterminatesched unlinks the group...

CVE-2026-80980

In the Linux kernel, the following vulnerability has been resolved: net/smc: stop killed, freed and outofsync sharing a byte The three connection state flags are single-bit bitfields, so they occupy one byte of struct smcconnection and every store to one is a read-modify-write of the other two: u...

PT-2026-96428

In the Linux kernel, the following vulnerability has been resolved: net/smc: stop killed, freed and out of sync sharing a byte The three connection state flags are single-bit bitfields, so they occupy one byte of struct smc connection and every store to one is a read-modify-write of the other two...

CVE-2026-80986: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages On a link whose device has maxrecvsge == 1 there is no shared v2 receive buffer, and smcllcsaveaddlinkrkeys takes the v2 extension from 44 bytes past the start of the...

CVE-2026-80983: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket refcount leak in smcswitchconns smcswitchconns takes a reference on the SMC socket before dropping lgr-connslock, so the connection stays alive while the CDC slot is fetched: sockhold&smc-sk;...

CVE-2026-80981: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free of the LLC qentry in smcllcsrvaddlink smcllcsrvaddlink keeps addllc pointing into the queue entry: addllc = &qentry-msg.addlink; smcllc.c:1482 ... smcllcsaveaddlinkinfolinknew, addllc; smcllc.c:1494...

CVE-2026-80982: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free in smcrxpipebufrelease smcrxsplice hands RMB pages to a pipe and takes a socket reference per entry so the smcsock stays alive until the reader finishes. The connection does not: a concurrent close run...

CVE-2026-80979: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/smc: unregister the connection before draining the rx tasklet smcconnfree calls smcismunsetconn only while the link group is still on its device list, and never sets conn-killed. smclgrterminatesched unlinks the group...

CVE-2026-80980: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/smc: stop killed, freed and outofsync sharing a byte The three connection state flags are single-bit bitfields, so they occupy one byte of struct smcconnection and every store to one is a read-modify-write of the other two: u...

PT-2026-90114

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the SMC-D teardown path where the system may dereference an unset send buffer. This occurs because smc close stream wait invokes smc tx prepared sends within a sk wait eve...

PT-2026-90109

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Shared Memory Communications SMC implementation of the Linux kernel. The smc conn free function calls smc ism unset conn only while the link group remains on its...

PT-2026-96404

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket refcount leak in smc switch conns smc switch conns takes a reference on the SMC socket before dropping lgr-conns lock, so the connection stays alive while the CDC slot is fetched: sock hold&smc-sk; read unlock...