CVE-2024-56640

What it actually does

Use-after-free in Linux kernel SMC module triggered by repeated refcount decrements on LGR and link structures when smc_conn_free is invoked without consistent sock lock protection in the listen path.

Why it matters to the business

Kernel crashes or memory corruption on systems using SMC networking can lead to service outages, unpredictable behavior in high-throughput environments, and potential escalation paths that require urgent patching to maintain uptime and compliance.

How an attack unfolds

An attacker triggers repeated connection abort and free paths in the SMC listen workqueue, causing refcount underflow or addition-on-zero warnings; this can be reached locally via crafted socket operations that race with termination work, leading to unsafe access of freed LGR or link objects.

How to fix it

Update the Linux kernel to a version containing the fix that adds sock lock protection around smc_conn_abort and related calls in smc_listen_work; apply the patch that serializes access in the listen path.

How to confirm the fix worked

Confirm the presence of sock lock acquisition before smc_conn_free in smc_listen_work; test by exercising concurrent listen and abort paths and verifying absence of refcount warnings in dmesg.

Typical attack path

1. Establish SMC connection from server listen path
2. Trigger concurrent abort or termination without holding sock lock
3. Cause duplicate smc_conn_free and smcr_link_put calls
4. Reach refcount zero or underflow on LGR/link
5. Access freed structures during subsequent workqueue processing

How to detect it

Search kernel logs for refcount_warn_saturate messages mentioning addition on 0 or underflow, smc_lgr_terminate_work, smcr_link_put, and smc_listen_work stack traces; correlate with processes creating SMC sockets.

• refcount_t: addition on 0; use-after-free
• refcount_t: underflow; use-after-free
• smc_lgr_terminate_work
• smcr_link_put
• smc_conn_free

What your security team should do

• Prioritize kernel updates on all systems exposing SMC sockets
• Monitor for refcount warnings in kernel logs as immediate detection signal
• Restrict SMC usage to trusted networks until patched
• Review downstream packages depending on the affected kernel for coordinated rollout