CVE-2026-80986 net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages

In the Linux kernel, the following vulnerability has been resolved: net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages On a link whose device has maxrecvsge == 1 there is no shared v2 receive buffer, and smcllcsaveaddlinkrkeys takes the v2 extension from 44 bytes past the start of the...

EUVD-2026-76308

In the Linux kernel, the following vulnerability has been resolved: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry smcllcrmtdeleterkey and smcllcsaveaddlinkrkeys read the part of a v2 message that does not fit into the 44-byte union smcllcmsg, and both bound themselves by the si...

CVE-2026-80985

In the Linux kernel, the following vulnerability has been resolved: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry smcllcrmtdeleterkey and smcllcsaveaddlinkrkeys read the part of a v2 message that does not fit into the 44-byte union smcllcmsg, and both bound themselves by the si...

EUVD-2026-76309

In the Linux kernel, the following vulnerability has been resolved: net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages On a link whose device has maxrecvsge == 1 there is no shared v2 receive buffer, and smcllcsaveaddlinkrkeys takes the v2 extension from 44 bytes past the start of the...

CVE-2026-80984 net/smc: do not dereference an unset send buffer on the SMC-D teardown path

In the Linux kernel, the following vulnerability has been resolved: net/smc: do not dereference an unset send buffer on the SMC-D teardown path smcclosestreamwait calls smctxpreparedsends from inside its skwaitevent condition, and skwaitevent evaluates that condition once with the socket lock...

CVE-2026-80984

CVE-2026-80984 is a NULL pointer dereference in the Linux kernel's net/smc subsystem on the SMC-D teardown path. When a link group terminates while a socket is waiting in smc_close_stream_wait(), the function smc_tx_prepared_sends() may dereference conn->sndbuf_desc after it has been cleared t...

CVE-2026-80984 net/smc: do not dereference an unset send buffer on the SMC-D teardown path

In the Linux kernel, the following vulnerability has been resolved: net/smc: do not dereference an unset send buffer on the SMC-D teardown path smcclosestreamwait calls smctxpreparedsends from inside its skwaitevent condition, and skwaitevent evaluates that condition once with the socket lock...

EUVD-2026-76307

In the Linux kernel, the following vulnerability has been resolved: net/smc: do not dereference an unset send buffer on the SMC-D teardown path smcclosestreamwait calls smctxpreparedsends from inside its skwaitevent condition, and skwaitevent evaluates that condition once with the socket lock...

CVE-2026-80982

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free in smcrxpipebufrelease smcrxsplice hands RMB pages to a pipe and takes a socket reference per entry so the smcsock stays alive until the reader finishes. The connection does not: a concurrent close run...

CVE-2026-80983

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket refcount leak in smcswitchconns smcswitchconns takes a reference on the SMC socket before dropping lgr-connslock, so the connection stays alive while the CDC slot is fetched: sockhold&smc-sk;...

CVE-2026-80982 net/smc: fix use-after-free in smc_rx_pipe_buf_release()

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free in smcrxpipebufrelease smcrxsplice hands RMB pages to a pipe and takes a socket reference per entry so the smcsock stays alive until the reader finishes. The connection does not: a concurrent close run...

CVE-2026-80983 net/smc: fix socket refcount leak in smc_switch_conns()

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket refcount leak in smcswitchconns smcswitchconns takes a reference on the SMC socket before dropping lgr-connslock, so the connection stays alive while the CDC slot is fetched: sockhold&smc-sk;...

CVE-2026-80983

CVE-2026-80983 is a socket reference count leak in the Linux kernel's SMC (Stream Mode Communication) networking module, specifically in the smc_switch_conns() function. The function calls sock_hold() before releasing lgr->conns_lock, but when smc_cdc_get_free_slot() fails (e.g., the target li...

EUVD-2026-76305

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free in smcrxpipebufrelease smcrxsplice hands RMB pages to a pipe and takes a socket reference per entry so the smcsock stays alive until the reader finishes. The connection does not: a concurrent close run...

CVE-2026-80982 net/smc: fix use-after-free in smc_rx_pipe_buf_release()

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free in smcrxpipebufrelease smcrxsplice hands RMB pages to a pipe and takes a socket reference per entry so the smcsock stays alive until the reader finishes. The connection does not: a concurrent close run...

EUVD-2026-76306

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket refcount leak in smcswitchconns smcswitchconns takes a reference on the SMC socket before dropping lgr-connslock, so the connection stays alive while the CDC slot is fetched: sockhold&smc-sk;...

CVE-2026-80983 net/smc: fix socket refcount leak in smc_switch_conns()

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket refcount leak in smcswitchconns smcswitchconns takes a reference on the SMC socket before dropping lgr-connslock, so the connection stays alive while the CDC slot is fetched: sockhold&smc-sk;...

CVE-2026-80982

CVE-2026-80982 is a use-after-free in the Linux kernel's SMC (Shared Memory Communications) network protocol (net/smc). The root cause is a race condition in smc_rx_pipe_buf_release(): it checks sk_state before acquiring the socket lock, so a concurrent smc_conn_free() can release the connection ...

CVE-2026-80981

CVE-2026-80981 is a use-after-free in the Linux kernel's net/smc (Scalable Multiconnect) networking component, specifically in smc_llc_srv_add_link(). The function retains a pointer (add_llc) into an LLC queue entry, then frees that entry via smc_llc_flow_qentry_del(), and subsequently dereferenc...

CVE-2026-80981 net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link()

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free of the LLC qentry in smcllcsrvaddlink smcllcsrvaddlink keeps addllc pointing into the queue entry: addllc = &qentry-msg.addlink; smcllc.c:1482 ... smcllcsaveaddlinkinfolinknew, addllc; smcllc.c:1494...