Cloudanix VulnDB

CVE-2025-40357

None

CVSS

—

EPSS

0.2%

Published

Dec 16, 2025

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel can make the system crash when certain network socket features run at the same time.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition during SMC socket creation allows concurrent diagnostic dump to dereference an uninitialized or incorrectly cast clcsock pointer, resulting in general protection fault and kernel crash.

Why it matters to the business

Systems using SMC sockets may experience unexpected kernel panics during diagnostic or monitoring operations, causing denial of service and potential loss of network connectivity until reboot.

How an attack unfolds

An attacker concurrently performs SMC socket creation (triggering inet_init_csk_locks and smc_sk_init) while a privileged or unprivileged process runs socket diagnostics via netlink, causing the diag path to visit a stale or invalid clcsock pointer and crash the kernel.

How to fix it

Apply the upstream fix in commit 5b6fc95c4a161326567bdf12a333768565b638f2 which removes the INET_PROTOSW_ICSK flag for SMC and reverts the related icsk_syn_mss change; update to a kernel containing this commit.

How to confirm the fix worked

Confirm the running kernel contains commit 5b6fc95c4a161326567bdf12a333768565b638f2; attempt to reproduce the original syzbot crash scenario to verify absence of the fault.

Typical attack path

  1. Create SMC socket via inet_create and smc_inet_init_sock
  2. Concurrently invoke netlink socket diagnostics (smc_diag_handler_dump)
  3. Race allows __smc_diag_dump to call smc_diag_msg_common_fill on invalid clcsock
  4. Kernel dereferences wild pointer and triggers oops

How to detect it

Search kernel logs and dmesg for oops messages referencing smc_diag_msg_common_fill, __smc_diag_dump, or general protection faults with addresses in the dead4ead or fbd5a5d5 ranges; inspect netlink dump activity around SMC socket creation events.

  • smc_diag_msg_common_fill
  • __smc_diag_dump.constprop.0
  • general protection fault.*smc_diag
  • KASAN: maybe wild-memory-access.*dead4ead

What your security team should do

  • Prioritize kernel updates containing the referenced commit on all systems exposing SMC sockets
  • Restrict unprivileged access to netlink socket diagnostics where feasible
  • Monitor kernel logs for smc_diag related oops entries

The record

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix general protection fault in __smc_diag_dump The syzbot report a crash: Oops: general protection fault, probably for non-canonical address 0xfbd5a5d5a0000003: 0000 [#1] SMP KASAN NOPTI KASAN: maybe wild-memory-access in range [0xdead4ead00000018-0xdead4ead0000001f] CPU: 1 UID: 0 PID: 6949 Comm: syz.0.335 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 RIP: 0010:smc_diag_msg_common_fill net/smc/smc_diag.c:44 [inline] RIP: 0010:__smc_diag_dump.constprop.0+0x3ca/0x2550 net/smc/smc_diag.c:89 Call Trace: <TASK> smc_diag_dump_proto+0x26d/0x420 net/smc/smc_diag.c:217 smc_diag_dump+0x27/0x90 net/smc/smc_diag.c:234 netlink_dump+0x539/0xd30 net/netlink/af_netlink.c:2327 __netlink_dump_start+0x6d6/0x990 net/netlink/af_netlink.c:2442 netlink_dump_start include/linux/netlink.h:341 [inline] smc_diag_handler_dump+0x1f9/0x240 net/smc/smc_diag.c:251 __sock_diag_cmd net/core/sock_diag.c:249 [inline] sock_diag_rcv_msg+0x438/0x790 net/core/sock_diag.c:285 netlink_rcv_skb+0x158/0x420 net/netlink/af_netlink.c:2552 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x5a7/0x870 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x8d1/0xdd0 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg net/socket.c:729 [inline] ____sys_sendmsg+0xa95/0xc70 net/socket.c:2614 ___sys_sendmsg+0x134/0x1d0 net/socket.c:2668 __sys_sendmsg+0x16d/0x220 net/socket.c:2700 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x4e0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f </TASK> The process like this: (CPU1) | (CPU2) ---------------------------------|------------------------------- inet_create() | // init clcsock to NULL | sk = sk_alloc() | | // unexpectedly change clcsock | inet_init_csk_locks() | | // add sk to hash table | smc_inet_init_sock() | smc_sk_init() | smc_hash_sk() | | // traverse the hash table | smc_diag_dump_proto | __smc_diag_dump() | // visit wrong clcsock | smc_diag_msg_common_fill() // alloc clcsock | smc_create_clcsk | sock_create_kern | With CONFIG_DEBUG_LOCK_ALLOC=y, the smc->clcsock is unexpectedly changed in inet_init_csk_locks(). The INET_PROTOSW_ICSK flag is no need by smc, just remove it. After removing the INET_PROTOSW_ICSK flag, this patch alse revert commit 6fd27ea183c2 ("net/smc: fix lacks of icsk_syn_mss with IPPROTO_SMC") to avoid casting smc_sock to inet_connection_sock.

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 6.11.0 6.12.56
openSUSE:Leap 16.0 dtb-aarch64 0 6.12.0-160000.9.1
openSUSE:Leap 16.0 kernel-64kb 0 6.12.0-160000.9.1
openSUSE:Leap 16.0 kernel-azure 0 6.12.0-160000.9.1
openSUSE:Leap 16.0 kernel-default 0 6.12.0-160000.9.1
openSUSE:Leap 16.0 kernel-default-base 0 6.12.0-160000.9.1.160000.2.6
openSUSE:Leap 16.0 kernel-docs 0 6.12.0-160000.9.1
openSUSE:Leap 16.0 kernel-kvmsmall 0 6.12.0-160000.9.1
openSUSE:Leap 16.0 kernel-obs-build 0 6.12.0-160000.9.1
openSUSE:Leap 16.0 kernel-obs-qa 0 6.12.0-160000.9.1
openSUSE:Leap 16.0 kernel-rt 0 6.12.0-160000.9.1
openSUSE:Leap 16.0 kernel-source 0 6.12.0-160000.9.1
openSUSE:Leap 16.0 kernel-syms 0 6.12.0-160000.9.1
openSUSE:Leap 16.0 kernel-zfcpdump 0 6.12.0-160000.9.1

Related vulnerabilities