CVE-2026-64541

In the Linux kernel, the following vulnerability has been resolved:

net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket

smc_cdc_rx_handler() looks up the connection by token under the link

group's conns_lock, drops the lock, and then dereferences conn and the

smc_sock derived from it, ending in sock_hold(&smc->sk) inside

smc_cdc_msg_recv(). No reference is held across the lock release.

The only reference pinning the socket while the connection is

discoverable in the link group is taken in smc_lgr_register_conn()

(sock_hold) and dropped in __smc_lgr_unregister_conn() (sock_put), both

under conns_lock. Once the handler drops conns_lock, a concurrent

close() -> smc_release() -> smc_conn_free() -> smc_lgr_unregister_conn()

can drop that reference and free the smc_sock, so the handler's later

sock_hold() runs on freed memory:

WARNING: lib/refcount.c:25 at refcount_warn_saturate

Workqueue: rxe_wq do_work

refcount_warn_saturate (lib/refcount.c:25)

smc_cdc_msg_recv (net/smc/smc_cdc.c:430)

smc_cdc_rx_handler (net/smc/smc_cdc.c:502)

smc_wr_rx_tasklet_fn (net/smc/smc_wr.c:445)

tasklet_action_common (kernel/softirq.c:938)

handle_softirqs (kernel/softirq.c:622)

Kernel panic - not syncing: panic_on_warn set

Only SMC-R is affected. The SMC-D receive tasklet is stopped by

tasklet_kill(&conn->rx_tsklet) in smc_conn_free() before the connection

is unregistered, so it cannot run concurrently with the free.

Take the socket reference while still holding conns_lock, so the

registration reference can no longer be the last one, and drop it once

the handler is done.