PT-2026-96428

In the Linux kernel, the following vulnerability has been resolved: net/smc: stop killed, freed and out of sync sharing a byte The three connection state flags are single-bit bitfields, so they occupy one byte of struct smc connection and every store to one is a read-modify-write of the other two...

CVE-2026-80986: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages On a link whose device has maxrecvsge == 1 there is no shared v2 receive buffer, and smcllcsaveaddlinkrkeys takes the v2 extension from 44 bytes past the start of the...

CVE-2026-80979: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/smc: unregister the connection before draining the rx tasklet smcconnfree calls smcismunsetconn only while the link group is still on its device list, and never sets conn-killed. smclgrterminatesched unlinks the group...

PT-2026-90114

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1 Description An issue exists in the SMC-D teardown path where the system may dereference an unset send buffer. This occurs because smc close stream wait invokes smc tx prepared sends within a sk wait eve...

PT-2026-90109

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Shared Memory Communications SMC implementation of the Linux kernel. The smc conn free function calls smc ism unset conn only while the link group remains on its...

CVE-2026-80984: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/smc: do not dereference an unset send buffer on the SMC-D teardown path smcclosestreamwait calls smctxpreparedsends from inside its skwaitevent condition, and skwaitevent evaluates that condition once with the socket lock...

CVE-2026-80980: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/smc: stop killed, freed and outofsync sharing a byte The three connection state flags are single-bit bitfields, so they occupy one byte of struct smcconnection and every store to one is a read-modify-write of the other two: u...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107307)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107307 advisory. In the Linux kernel, the following vulnerability has been resolved: net/smc: check ipareaoffset and ipv6prefixescnt when receiving proposal msg When receiving propos...

PT-2026-96382

In the Linux kernel, the following vulnerability has been resolved: net/smc: do not dereference an unset send buffer on the SMC-D teardown path smc close stream wait calls smc tx prepared sends from inside its sk wait event condition, and sk wait event evaluates that condition once with the socke...

CVE-2026-80985: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry smcllcrmtdeleterkey and smcllcsaveaddlinkrkeys read the part of a v2 message that does not fit into the 44-byte union smcllcmsg, and both bound themselves by the si...

CVE-2026-80982: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free in smcrxpipebufrelease smcrxsplice hands RMB pages to a pipe and takes a socket reference per entry so the smcsock stays alive until the reader finishes. The connection does not: a concurrent close run...

CVE-2026-80983: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket refcount leak in smcswitchconns smcswitchconns takes a reference on the SMC socket before dropping lgr-connslock, so the connection stays alive while the CDC slot is fetched: sockhold&smc-sk;...

PT-2026-96375

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free in smc rx pipe buf release smc rx splice hands RMB pages to a pipe and takes a socket reference per entry so the smc sock stays alive until the reader finishes. The connection does not: a concurrent...

PT-2026-96404

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket refcount leak in smc switch conns smc switch conns takes a reference on the SMC socket before dropping lgr-conns lock, so the connection stays alive while the CDC slot is fetched: sock hold&smc-sk; read unlock...

CVE-2026-80981: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free of the LLC qentry in smcllcsrvaddlink smcllcsrvaddlink keeps addllc pointing into the queue entry: addllc = &qentry-msg.addlink; smcllc.c:1482 ... smcllcsaveaddlinkinfolinknew, addllc; smcllc.c:1494...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107311)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107311 advisory. In the Linux kernel, the following vulnerability has been resolved: net/smc: Fix possible access to freed memory in link clear After modifying the QP to the Error...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-107261)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107261 advisory. In the Linux kernel, the following vulnerability has been resolved: net/smc: fix kernel panic caused by race of smcsock A crash occurs when smccdctxhandler tries to...

kernel: Revert "net/smc: Introduce TCP ULP support"

A flaw was found in the Linux kernel's TCP User-Level Protocol ULP support for SMC. This vulnerability arises when an active TCP socket is converted into an SMC socket, as the implementation attempts to modify core Virtual File System VFS structures in-place. This action violates fundamental VFS...

SMC Protocol Heap Buffer Overflow DoS

The vulnerability of the smcv2determineacceptedchid function in the net/smc/afsmc.c module of the SMC protocol family in the Linux operating system’s kernel is related to the use of pointers. Exploiting this vulnerability could allow a remote attacker to cause service interruptions...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053178)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053178 advisory. In the Linux kernel, the following vulnerability has been resolved: net/smc: remove device from smcddevlist after failed deviceadd If the deviceadd for a smcddev...