Cloudanix VulnDB

CVE-2026-99032

High · 7.8

CVSS

7.8

EPSS

0.2%

Published

Oct 23, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the Linux kernel's network code could let someone logged into the machine crash it or potentially take control.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Race condition in smc_getname allows dereference of smc->clcsock without clcsock_release_lock, enabling use-after-free or NULL dereference when link-group termination releases the CLC socket via smc_close_active_abort while a getsockname syscall is in progress.

Why it matters to the business

Local users on affected Linux systems can trigger kernel crashes or potential privilege escalation, leading to denial of service or compromise of systems relying on SMC sockets for high-performance networking.

How an attack unfolds

An attacker with local access opens an SMC socket, triggers asynchronous link-group termination (for example via shutdown), and concurrently invokes getsockname to race with clcsock release, causing the kernel to access freed memory or a cleared pointer.

How to fix it

Apply the upstream fix that holds clcsock_release_lock across the pointer check and getname callback, returning -EBADF if the CLC socket has already been released; rebuild and deploy the patched kernel across all affected systems.

How to confirm the fix worked

Verify the presence of the lock acquisition in smc_getname, run reproduction tests under KASAN, and confirm that getsockname returns -EBADF or the expected value without crashing after termination.

Typical attack path

  1. Create an SMC socket and perform operations such as shutdown(SHUT_WR)
  2. Trigger link-group termination through smc_close_active_abort or lgr termination
  3. Concurrently call getsockname on the SMC socket from another thread
  4. Access freed clcsock memory or dereference a NULL pointer during the getname callback

How to detect it

Search kernel logs for KASAN slab-use-after-free reports mentioning smc_getname, smc_clcsock_release, or smc_close_active_abort; inspect crash dumps for the call trace involving do_getsockname and __sys_getsockname.

  • BUG: KASAN: slab-use-after-free in smc_getname
  • smc_getname+0x19e/0x1b0
  • smc_clcsock_release+0xa8/0xd0
  • smc_close_active_abort+0x26a/0x3a0

What your security team should do

  • Prioritize kernel updates on all systems using SMC sockets within the next patching cycle
  • Monitor for KASAN reports or NULL dereference crashes involving smc_getname
  • Restrict untrusted local access on systems where SMC is enabled until patched

The record

In the Linux kernel, the following vulnerability has been resolved: net/smc: protect clcsock lifetime in smc_getname smc_getname() dereferences smc->clcsock without holding clcsock_release_lock. Link-group termination can release the CLC socket through smc_close_active_abort() while the SMC socket is still open, for example after shutdown(SHUT_WR). A getsockname() caller can load smc->clcsock, then the termination worker can clear the pointer and call sock_release() before the caller accesses clcsock->ops or invokes getname(). This causes a use-after-free; if the worker clears the pointer before the load, it causes a NULL dereference. The syscall's file reference keeps the SMC socket alive but does not prevent asynchronous release of its CLC socket. KASAN reported the following with test-only timing instrumentation: BUG: KASAN: slab-use-after-free in smc_getname+0x19e/0x1b0 Read of size 8 at addr ffff888109abb4e0 by task poc/103 Call Trace: smc_getname+0x19e/0x1b0 do_getsockname+0xe5/0x170 __sys_getsockname+0x8c/0x100 Allocated by task 95: sock_alloc_inode+0x1e/0x280 sock_alloc+0x3d/0x240 __sock_create+0x7e/0x430 smc_create+0x121/0x240 Freed by task 0: kmem_cache_free+0xcc/0x340 rcu_core+0x50a/0x1850 Last potentially related work creation: evict+0x446/0x6c0 smc_clcsock_release+0xa8/0xd0 smc_close_active_abort+0x26a/0x3a0 __smc_lgr_terminate.part.0+0x137/0x2e0 Hold clcsock_release_lock across the pointer check and the getname() callback to serialize with smc_clcsock_release(). Return -EBADF if the CLC socket has already been released, preserving the existing peer state check and the callback's return value otherwise.

Affected packages

Ecosystem Package Introduced Fixed