kernel: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket

A flaw was found in the Linux kernel's Shared Memory Communications over RDMA SMC-R subsystem. A race condition allows a network socket to be released and freed while incoming messages are still being processed, leading to a use-after-free condition. A local attacker interacting with active SMC-R...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

kernel: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket

A flaw was found in the Linux kernel's Shared Memory Communications over RDMA SMC-R subsystem. A race condition allows a network socket to be released and freed while incoming messages are still being processed, leading to a use-after-free condition. A local attacker interacting with active SMC-R...

kernel: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket

A flaw was found in the Linux kernel's Shared Memory Communications over RDMA SMC-R subsystem. A race condition allows a network socket to be released and freed while incoming messages are still being processed, leading to a use-after-free condition. A local attacker interacting with active SMC-R...

AZL-94026 CVE-2026-64541 affecting package kernel for versions less than 6.6.145.2-1

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF in smccdcrxhandler by pinning the socket smccdcrxhandler looks up the connection by token under the link group's connslock, drops the lock, and then dereferences conn and the smcsock derived from it, ending in...

CVE-2026-64541

The CVE-2026-64541 issue affects the Linux kernel SMC-R stack (net/smc) and is caused by a UAF in smc_cdc_rx_handler() when the socket is freed while a connection is still discoverable. The description states that smc_cdc_rx_handler() looks up the connection by token under conns_lock, releases th...

CVE-2026-64541 net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF in smccdcrxhandler by pinning the socket smccdcrxhandler looks up the connection by token under the link group's connslock, drops the lock, and then dereferences conn and the smcsock derived from it, ending in...

CVE-2026-64541: Use After Free

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF in smccdcrxhandler by pinning the socket smccdcrxhandler looks up the connection by token under the link group's connslock, drops the lock, and then dereferences conn and the smcsock derived from it, ending in...