CVE-2026-80983 (GCVE-0-2026-80983)
Vulnerability from cvelistv5
Published
2026-09-11 19:42
Modified
2026-10-19 08:46
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix socket refcount leak in smc_switch_conns() smc_switch_conns() takes a reference on the SMC socket before dropping lgr->conns_lock, so the connection stays alive while the CDC slot is fetched: sock_hold(&smc->sk); read_unlock_bh(&lgr->conns_lock); /* pre-fetch buffer outside of send_lock, might sleep */ rc = smc_cdc_get_free_slot(conn, to_lnk, &wr_buf, NULL, &pend); if (rc) goto err_out; The err_out label only drops the wr_tx link reference, so this early exit returns without the matching sock_put(). The second error exit is not affected, because sock_put() has already run by then. A leaked sk_refcnt means the smc_sock is never destroyed. Its send and receive buffers stay allocated, and for a user socket the reference held on the network namespace is never released, so the netns can no longer be torn down. smc_cdc_get_free_slot() fails when the target link goes down or when the connection has been killed while the switch is in progress. Both are reachable during the link failover this function implements, so the leak is triggered by the same hardware events that make smc_switch_conns() run in the first place. Restructure so there is a single sock_put() covering both outcomes, instead of adding a second one to the error path.
References
Impacted products
Vendor Product Version
Linux Linux Version: 95f7f3e7dc6bd2e735cb5de11734ea2222b1e05a
Version: 95f7f3e7dc6bd2e735cb5de11734ea2222b1e05a
Version: 95f7f3e7dc6bd2e735cb5de11734ea2222b1e05a
Version: 95f7f3e7dc6bd2e735cb5de11734ea2222b1e05a
Version: 95f7f3e7dc6bd2e735cb5de11734ea2222b1e05a
Version: 95f7f3e7dc6bd2e735cb5de11734ea2222b1e05a
Version: 95f7f3e7dc6bd2e735cb5de11734ea2222b1e05a
Version: 99f19566b1c4d3dc4d934ee2ef43faadebb56d70
Version: 0d9ddf515cde793841f738490037560fd6559c63
Version: 5.10.90   ≤
Version: 5.14.14   ≤
Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/smc/smc_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a3378466704e0bbe93aef9769552dca7673a7eb6",
              "status": "affected",
              "version": "95f7f3e7dc6bd2e735cb5de11734ea2222b1e05a",
              "versionType": "git"
            },
            {
              "lessThan": "e20227019d9da73f8fdf16f0951c2e188c84933f",
              "status": "affected",
              "version": "95f7f3e7dc6bd2e735cb5de11734ea2222b1e05a",
              "versionType": "git"
            },
            {
              "lessThan": "09d7a9e162ee1a269878c126aee3d7eff43e4130",
              "status": "affected",
              "version": "95f7f3e7dc6bd2e735cb5de11734ea2222b1e05a",
              "versionType": "git"
            },
            {
              "lessThan": "84dea0585f6b538ae895a8b1d025f4897737f3b1",
              "status": "affected",
              "version": "95f7f3e7dc6bd2e735cb5de11734ea2222b1e05a",
              "versionType": "git"
            },
            {
              "lessThan": "d89dc1bd8845c669a700eee58c64ebd3cc1b6d2d",
              "status": "affected",
              "version": "95f7f3e7dc6bd2e735cb5de11734ea2222b1e05a",
              "versionType": "git"
            },
            {
              "lessThan": "d9a879ac25958bdaecb669ce70e58f8e2ff170de",
              "status": "affected",
              "version": "95f7f3e7dc6bd2e735cb5de11734ea2222b1e05a",
              "versionType": "git"
            },
            {
              "lessThan": "719296c4aa8213d4ac8002e77d5956d436bc98d0",
              "status": "affected",
              "version": "95f7f3e7dc6bd2e735cb5de11734ea2222b1e05a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "99f19566b1c4d3dc4d934ee2ef43faadebb56d70",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0d9ddf515cde793841f738490037560fd6559c63",
              "versionType": "git"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.90",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15",
              "status": "affected",
              "version": "5.14.14",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/smc/smc_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.15"
            },
            {
              "lessThan": "5.15",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "5.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.90",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.14.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix socket refcount leak in smc_switch_conns()\n\nsmc_switch_conns() takes a reference on the SMC socket before dropping\nlgr-\u003econns_lock, so the connection stays alive while the CDC slot is\nfetched:\n\n        sock_hold(\u0026smc-\u003esk);\n        read_unlock_bh(\u0026lgr-\u003econns_lock);\n        /* pre-fetch buffer outside of send_lock, might sleep */\n        rc = smc_cdc_get_free_slot(conn, to_lnk, \u0026wr_buf, NULL, \u0026pend);\n        if (rc)\n                goto err_out;\n\nThe err_out label only drops the wr_tx link reference, so this early exit\nreturns without the matching sock_put(). The second error exit is not\naffected, because sock_put() has already run by then.\n\nA leaked sk_refcnt means the smc_sock is never destroyed. Its send and\nreceive buffers stay allocated, and for a user socket the reference held\non the network namespace is never released, so the netns can no longer be\ntorn down.\n\nsmc_cdc_get_free_slot() fails when the target link goes down or when the\nconnection has been killed while the switch is in progress. Both are\nreachable during the link failover this function implements, so the leak\nis triggered by the same hardware events that make smc_switch_conns() run\nin the first place.\n\nRestructure so there is a single sock_put() covering both outcomes,\ninstead of adding a second one to the error path."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:46:07.693Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a3378466704e0bbe93aef9769552dca7673a7eb6"
        },
        {
          "url": "https://git.kernel.org/stable/c/e20227019d9da73f8fdf16f0951c2e188c84933f"
        },
        {
          "url": "https://git.kernel.org/stable/c/09d7a9e162ee1a269878c126aee3d7eff43e4130"
        },
        {
          "url": "https://git.kernel.org/stable/c/84dea0585f6b538ae895a8b1d025f4897737f3b1"
        },
        {
          "url": "https://git.kernel.org/stable/c/d89dc1bd8845c669a700eee58c64ebd3cc1b6d2d"
        },
        {
          "url": "https://git.kernel.org/stable/c/d9a879ac25958bdaecb669ce70e58f8e2ff170de"
        },
        {
          "url": "https://git.kernel.org/stable/c/719296c4aa8213d4ac8002e77d5956d436bc98d0"
        }
      ],
      "title": "net/smc: fix socket refcount leak in smc_switch_conns()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80983",
    "datePublished": "2026-09-11T19:42:42.912Z",
    "dateReserved": "2026-08-26T14:34:25.811Z",
    "dateUpdated": "2026-10-19T08:46:07.693Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.