411128 matches found
CVE-2026-80984
CVE-2026-80984 is a NULL pointer dereference in the Linux kernel's net/smc subsystem on the SMC-D teardown path. When a link group terminates while a socket is waiting in smc_close_stream_wait(), the function smc_tx_prepared_sends() may dereference conn->sndbuf_desc after it has been cleared t...
CVE-2026-80984 net/smc: do not dereference an unset send buffer on the SMC-D teardown path
In the Linux kernel, the following vulnerability has been resolved: net/smc: do not dereference an unset send buffer on the SMC-D teardown path smcclosestreamwait calls smctxpreparedsends from inside its skwaitevent condition, and skwaitevent evaluates that condition once with the socket lock...
CVE-2026-80984
In the Linux kernel, the following vulnerability has been resolved: net/smc: do not dereference an unset send buffer on the SMC-D teardown path smcclosestreamwait calls smctxpreparedsends from inside its skwaitevent condition, and skwaitevent evaluates that condition once with the socket lock...
CVE-2026-80984 net/smc: do not dereference an unset send buffer on the SMC-D teardown path
In the Linux kernel, the following vulnerability has been resolved: net/smc: do not dereference an unset send buffer on the SMC-D teardown path smcclosestreamwait calls smctxpreparedsends from inside its skwaitevent condition, and skwaitevent evaluates that condition once with the socket lock...
EUVD-2026-76307
In the Linux kernel, the following vulnerability has been resolved: net/smc: do not dereference an unset send buffer on the SMC-D teardown path smcclosestreamwait calls smctxpreparedsends from inside its skwaitevent condition, and skwaitevent evaluates that condition once with the socket lock...
CVE-2026-80983 net/smc: fix socket refcount leak in smc_switch_conns()
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket refcount leak in smcswitchconns smcswitchconns takes a reference on the SMC socket before dropping lgr-connslock, so the connection stays alive while the CDC slot is fetched: sockhold&smc-sk;...
CVE-2026-80983
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket refcount leak in smcswitchconns smcswitchconns takes a reference on the SMC socket before dropping lgr-connslock, so the connection stays alive while the CDC slot is fetched: sockhold&smc-sk;...
CVE-2026-80983
CVE-2026-80983 is a socket reference count leak in the Linux kernel's SMC (Stream Mode Communication) networking module, specifically in the smc_switch_conns() function. The function calls sock_hold() before releasing lgr->conns_lock, but when smc_cdc_get_free_slot() fails (e.g., the target li...
EUVD-2026-76306
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket refcount leak in smcswitchconns smcswitchconns takes a reference on the SMC socket before dropping lgr-connslock, so the connection stays alive while the CDC slot is fetched: sockhold&smc-sk;...
CVE-2026-80983 net/smc: fix socket refcount leak in smc_switch_conns()
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket refcount leak in smcswitchconns smcswitchconns takes a reference on the SMC socket before dropping lgr-connslock, so the connection stays alive while the CDC slot is fetched: sockhold&smc-sk;...
CVE-2026-80981
CVE-2026-80981 is a use-after-free in the Linux kernel's net/smc (Scalable Multiconnect) networking component, specifically in smc_llc_srv_add_link(). The function retains a pointer (add_llc) into an LLC queue entry, then frees that entry via smc_llc_flow_qentry_del(), and subsequently dereferenc...
CVE-2026-80981 net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link()
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free of the LLC qentry in smcllcsrvaddlink smcllcsrvaddlink keeps addllc pointing into the queue entry: addllc = &qentry-msg.addlink; smcllc.c:1482 ... smcllcsaveaddlinkinfolinknew, addllc; smcllc.c:1494...
CVE-2026-80981
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free of the LLC qentry in smcllcsrvaddlink smcllcsrvaddlink keeps addllc pointing into the queue entry: addllc = &qentry-msg.addlink; smcllc.c:1482 ... smcllcsaveaddlinkinfolinknew, addllc; smcllc.c:1494...
CVE-2026-80981 net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link()
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free of the LLC qentry in smcllcsrvaddlink smcllcsrvaddlink keeps addllc pointing into the queue entry: addllc = &qentry-msg.addlink; smcllc.c:1482 ... smcllcsaveaddlinkinfolinknew, addllc; smcllc.c:1494...
EUVD-2026-76304
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free of the LLC qentry in smcllcsrvaddlink smcllcsrvaddlink keeps addllc pointing into the queue entry: addllc = &qentry-msg.addlink; smcllc.c:1482 ... smcllcsaveaddlinkinfolinknew, addllc; smcllc.c:1494...
CVE-2026-80979
CVE-2026-80979 is a use-after-free in the Linux kernel's Shared Memory Communications (SMC) component (net/smc). During connection termination, a race between smc_conn_free() and smc_lgr_terminate_sched() allows the device to re-arm the receive tasklet after tasklet_kill() returns. On the DMB-noc...
CVE-2026-80979 net/smc: unregister the connection before draining the rx tasklet
In the Linux kernel, the following vulnerability has been resolved: net/smc: unregister the connection before draining the rx tasklet smcconnfree calls smcismunsetconn only while the link group is still on its device list, and never sets conn-killed. smclgrterminatesched unlinks the group...
EUVD-2026-76302
In the Linux kernel, the following vulnerability has been resolved: net/smc: unregister the connection before draining the rx tasklet smcconnfree calls smcismunsetconn only while the link group is still on its device list, and never sets conn-killed. smclgrterminatesched unlinks the group...
CVE-2026-80979
In the Linux kernel, the following vulnerability has been resolved: net/smc: unregister the connection before draining the rx tasklet smcconnfree calls smcismunsetconn only while the link group is still on its device list, and never sets conn-killed. smclgrterminatesched unlinks the group...
CVE-2026-80979 net/smc: unregister the connection before draining the rx tasklet
In the Linux kernel, the following vulnerability has been resolved: net/smc: unregister the connection before draining the rx tasklet smcconnfree calls smcismunsetconn only while the link group is still on its device list, and never sets conn-killed. smclgrterminatesched unlinks the group...