CVE-2026-64541: net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket

smc_cdc_rx_handler() looks up the connection by token under the link
group's conns_lock, drops the lock, and then dereferences conn and the
smc_sock derived from it, ending in sock_hold(&smc->sk) inside
smc_cdc_msg_recv(). No reference is held across the lock release.

The only reference pinning the socket while the connection is
discoverable in the link group is taken in smc_lgr_register_conn()
(sock_hold) and dropped in __smc_lgr_unregister_conn() (sock_put), both
under conns_lock. Once the handler drops conns_lock, a concurrent
close() -> smc_release() -> smc_conn_free() -> smc_lgr_unregister_conn()
can drop that reference and free the smc_sock, so the handler's later
sock_hold() runs on freed memory:

  WARNING: lib/refcount.c:25 at refcount_warn_saturate
  Workqueue: rxe_wq do_work
   refcount_warn_saturate (lib/refcount.c:25)
   smc_cdc_msg_recv (net/smc/smc_cdc.c:430)
   smc_cdc_rx_handler (net/smc/smc_cdc.c:502)
   smc_wr_rx_tasklet_fn (net/smc/smc_wr.c:445)
   tasklet_action_common (kernel/softirq.c:938)
   handle_softirqs (kernel/softirq.c:622)
  Kernel panic - not syncing: panic_on_warn set

Only SMC-R is affected. The SMC-D receive tasklet is stopped by
tasklet_kill(&conn->rx_tsklet) in smc_conn_free() before the connection
is unregistered, so it cannot run concurrently with the free.

Take the socket reference while still holding conns_lock, so the
registration reference can no longer be the last one, and drop it once
the handler is done.

The Linux kernel CVE team has assigned CVE-2026-64541 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.18 with commit d7b0e37c1ac152905b18a5b9506179091a35b0b6 and fixed in 5.10.261 with commit 8de4f665d0febfb92803dece377791a563fc7041
	Issue introduced in 4.18 with commit d7b0e37c1ac152905b18a5b9506179091a35b0b6 and fixed in 5.15.212 with commit 8145b432136285e01091815b48ceb2dae261f262
	Issue introduced in 4.18 with commit d7b0e37c1ac152905b18a5b9506179091a35b0b6 and fixed in 6.1.178 with commit 1951bffbc6493ec34cff3956b29d4bc6606904a6
	Issue introduced in 4.18 with commit d7b0e37c1ac152905b18a5b9506179091a35b0b6 and fixed in 6.6.145 with commit 647b19e5cc145a2f1f685ae8ff3805a17356888c
	Issue introduced in 4.18 with commit d7b0e37c1ac152905b18a5b9506179091a35b0b6 and fixed in 6.12.97 with commit 472e9d7c0d5b03be3ff91ff941f57da822b031bc
	Issue introduced in 4.18 with commit d7b0e37c1ac152905b18a5b9506179091a35b0b6 and fixed in 6.18.40 with commit 3bfb96d9bc6a7ed0b99c7db329cc2e22a28d84bb
	Issue introduced in 4.18 with commit d7b0e37c1ac152905b18a5b9506179091a35b0b6 and fixed in 7.1.5 with commit ce5aa8084329351086894aa34d77e40301d5bd3d
	Issue introduced in 4.18 with commit d7b0e37c1ac152905b18a5b9506179091a35b0b6 and fixed in 7.2-rc3 with commit 9d160b35cc34a2ba8229d07651468a7848325135

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64541
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/smc/smc_cdc.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/8de4f665d0febfb92803dece377791a563fc7041
	https://git.kernel.org/stable/c/8145b432136285e01091815b48ceb2dae261f262
	https://git.kernel.org/stable/c/1951bffbc6493ec34cff3956b29d4bc6606904a6
	https://git.kernel.org/stable/c/647b19e5cc145a2f1f685ae8ff3805a17356888c
	https://git.kernel.org/stable/c/472e9d7c0d5b03be3ff91ff941f57da822b031bc
	https://git.kernel.org/stable/c/3bfb96d9bc6a7ed0b99c7db329cc2e22a28d84bb
	https://git.kernel.org/stable/c/ce5aa8084329351086894aa34d77e40301d5bd3d
	https://git.kernel.org/stable/c/9d160b35cc34a2ba8229d07651468a7848325135