EUVD-2026-76303
GHSA-74wv-6pxv-7x55
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
SMC must be in use and a tight softirq-vs-process race won (AV:L/AC:H/PR:L); outcome is state corruption with minor integrity/availability impact and no confidentiality loss.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
net/smc: stop killed, freed and out_of_sync sharing a byte
The three connection state flags are single-bit bitfields, so they occupy one byte of struct smc_connection and every store to one is a read-modify-write of the other two:
u8 killed : 1; u8 freed : 1; u8 out_of_sync : 1;
They are not written under a common lock. smc_cdc_msg_validate() sets out_of_sync from the receive tasklet, while smc_conn_kill() sets killed from process context under lock_sock(), and the receive path does not defer to the backlog when the socket is owned -- smc_cdc_msg_recv() takes only bh_lock_sock().
Give each flag its own byte so a store no longer touches its neighbours. All readers test them as booleans and are unchanged. struct smc_connection grows by two bytes.
AnalysisAI
A data race in the Linux kernel's net/smc (Shared Memory Communications) subsystem allows concurrent stores to the killed, freed, and out_of_sync connection-state flags to clobber one another because all three single-bit bitfields share one byte of struct smc_connection. The receive tasklet (smc_cdc_msg_validate) and process context (smc_conn_kill) write these flags without a common lock, so each write is a read-modify-write that can silently revert a neighbouring flag, potentially corrupting connection teardown/free state. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the SMC subsystem to be in active use: the kernel must be built with SMC support and the host must have live SMC-R or SMC-D (RDMA/ISM) connections. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) is not credible for this defect and appears to be an automated worst-case default applied to a kernel commit. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor kernel update: upgrade to Linux 6.18.50, 7.2.4, or mainline 7.3-rc1 or later, or the corresponding backport shipped by your distribution (the fix is the three commits at git.kernel.org referenced above). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify Linux systems running vulnerable kernel versions and assess SMC subsystem utilization across your infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today