High 7.8Published Oct 23, 2026

CVE-2026-99032net/smc: protect clcsock lifetime in smc_getname

Updated under an hour ago (Oct 28, 2026, 6:10 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

EPSS puts the chance of exploitation in the next 30 days at 0.16%, higher than 5% of scored CVEs.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net/smc: protect clcsock lifetime in smc_getname smc_getname() dereferences smc->clcsock without holding clcsock_release_lock. Link-group termination can release the CLC socket through smc_close_active_abort() while the SMC socket is still open, for example after shutdown(SHUT_WR). A getsockname() caller can load smc->clcsock, then the termination worker can clear the pointer and call sock_release() before the caller accesses clcsock->ops or invokes getname(). This causes a use-after-free; if the worker clears the pointer before the load, it causes a NULL dereference. The syscall's file reference keeps the SMC socket alive but does not prevent asynchronous release of its CLC socket. KASAN reported the following with test-only timing instrumentation: BUG: KASAN: slab-use-after-free in smc_getname+0x19e/0x1b0 Read of size 8 at addr ffff888109abb4e0 by task poc/103 Call Trace: smc_getname+0x19e/0x1b0 do_getsockname+0xe5/0x170 __sys_getsockname+0x8c/0x100 Allocated by task 95: sock_alloc_inode+0x1e/0x280 sock_alloc+0x3d/0x240 __sock_create+0x7e/0x430 smc_create+0x121/0x240 Freed by task 0: kmem_cache_free+0xcc/0x340 rcu_core+0x50a/0x1850 Last potentially related work creation: evict+0x446/0x6c0 smc_clcsock_release+0xa8/0xd0 smc_close_active_abort+0x26a/0x3a0 __smc_lgr_terminate.part.0+0x137/0x2e0 Hold clcsock_release_lock across the pointer check and the getname() callback to serialize with smc_clcsock_release(). Return -EBADF if the CLC socket has already been released, preserving the existing peer state check and the callback's return value otherwise.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): 0.16% (percentile 5)
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 24, 2026
First seen by InfoSec Signals: Oct 23, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from b03faa1fafc8018295401dc558bdc76362d860a4 before e607017a553d2a48e428ec8b8ffb06bf3bb92ce9; from b03faa1fafc8018295401dc558bdc76362d860a4 before 1512e3714b3946bda75a160a34f22a51710daa43; from b03faa1fafc8018295401dc558bdc76362d860a4 before 6a1833f0d7dc037c8e876b9178ba69d5d107c086; from b03faa1fafc8018295401dc558bdc76362d860a4 before c223da71abfaea2ebb1c7208ae9ebf15038f9388; from b03faa1fafc8018295401dc558bdc76362d860a4 before 64a6b36b0e1855288080bc5f89769f27d6dc03c8; 0b6153d04c96a1d4b6284692386aa21d04d7956c; from 4.19.299 before 4.20	CNA record

References

References

https://git.kernel.org/stable/c/e607017a553d2a48e428ec8b8ffb06bf3bb92ce9
https://git.kernel.org/stable/c/1512e3714b3946bda75a160a34f22a51710daa43
https://git.kernel.org/stable/c/6a1833f0d7dc037c8e876b9178ba69d5d107c086
https://git.kernel.org/stable/c/c223da71abfaea2ebb1c7208ae9ebf15038f9388
https://git.kernel.org/stable/c/64a6b36b0e1855288080bc5f89769f27d6dc03c8

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.