CVE-2026-90065

In the Linux kernel, the following vulnerability has been resolved:

net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure

IPPROTO_SMC sockets create an internal TCP sock ("clcsock") from the

proto->init hook. When socket creation fails after proto->init has

run - e.g. a cgroup BPF program attached to BPF_CGROUP_INET_SOCK_CREATE

denies the socket - sk_common_release() only invokes sk_prot->destroy

if it is set, but neither smc_inet_prot nor smc_inet6_prot defines it,

and smc_destruct() returns early unless sk_state is SMC_CLOSED. As a

result, every failing socket(AF_INET, SOCK_STREAM, IPPROTO_SMC) call

leaks one tcp_sock, so an unprivileged task able to attach a deny-all

BPF_CGROUP_INET_SOCK_CREATE program to its own cgroup can grow kernel

memory unboundedly.

Add a .destroy hook to both protos that releases the clcsock via

smc_clcsock_release(). smc_sk_init() hashes the sock into the smc

hashinfo before the clcsock is created, and smc_diag dumps walk that

hash dereferencing smc->clcsock without taking clcsock_release_lock,

while sk_common_release() calls .destroy before .unhash. Unhash the

sock before releasing the clcsock, as __smc_release() does, so a

concurrent dump cannot observe the release; the second unhash in

sk_common_release() is a no-op.