Linux Kernel CVE-2025-40012

Requires the SMC subsystem to be loaded and an SMC socket usable by the attacker specifically over the software loopback DMB path (smc_lo_register_dmb), which is not present in default/typical Linux deployments that never enable SMC. The attacker must be a local user (AV:L) with at least low privileges sufficient to open an AF_SMC socket and invoke splice()/sock_splice_read() on it. Triggering the benign WARN_ON_ONCE is straightforward, but achieving the actual use-after-free requires winning a race window in which the DMB buffer is freed before splice_to_pipe() finishes - a real limiting factor. Exploitation is further constrained to environments where SMC is deliberately configured, most commonly IBM Z / s390 or SMC-D-enabled hosts.

The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.8 High) reflects local, low-privilege access with high impact typical of an autogenerated kernel-UAF score. Real-world risk is considerably lower than 7.8 suggests: EPSS is only 0.22% (13th percentile), the CVE is not in CISA KEV, and no public exploit is identified. Reliably reaching memory corruption (rather than just the WARN) requires winning a race - the buffer must be freed before splice_to_pipe() completes - so the practical attack complexity is higher than the AC:L rating implies. Additionally, exploitation depends on the SMC subsystem being loaded and an SMC socket (loopback DMB path) being usable by the attacker, which is uncommon outside IBM Z/mainframe or specifically SMC-enabled deployments. The 'Information Disclosure' tag is plausible for a UAF but not confirmed by a CWE (listed N/A). Net: a legitimate local kernel hardening fix, but not an urgent widespread-exploitation priority - patch on normal kernel-update cadence unless SMC is in active use.

A local, low-privileged user on a system with the SMC module loaded opens an AF_SMC socket over the loopback DMB path, then issues a splice() syscall to zero-copy received data into a pipe, driving smc_rx_splice() to call get_page() on the kmalloc-backed DMB. By racing buffer release against splice_to_pipe() completion, the attacker turns the reliably-triggered WARN into a use-after-free, potentially disclosing freed kernel memory or corrupting kernel state for privilege escalation. No public proof-of-concept exists at time of analysis, and the reproduction requires the SMC subsystem to be active.