EUVD-2026-76305
GHSA-vr9j-9w5f-vmw6
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition must be won between splice release and connection free, justifying AC:H over input's AC:L; local low-priv access and full memory impact otherwise unchanged.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
net/smc: fix use-after-free in smc_rx_pipe_buf_release()
smc_rx_splice() hands RMB pages to a pipe and takes a socket reference per entry so the smc_sock stays alive until the reader finishes. The connection does not: a concurrent close runs smc_conn_free(), which releases the receive buffer back to the link group pool.
smc_rx_pipe_buf_release() tests sk_state before taking the socket lock. The state can change between the test and the lock, and smc_rx_update_cons() then dereferences conn->rmb_desc and walks conn->lgr, which smc_conn_free() has already released. On the is_reg_err path smcr_buf_unuse() frees the descriptor outright, so this is a use-after-free.
Take the socket lock first and test conn->freed instead. smc_conn_free() sets that flag before releasing anything, and every caller holds the socket lock. The two paths exclude each other: either the pipe release runs first with everything valid, or it sees the flag and skips the update.
AnalysisAI
Use-after-free in the Linux kernel's SMC (Shared Memory Communications) subsystem, introduced circa v4.18, allows a local low-privileged user to corrupt kernel memory with full read, write, and availability impact. The race condition arises because smc_rx_pipe_buf_release() tests sk_state before acquiring the socket lock, permitting a concurrent smc_conn_free() call to release conn->rmb_desc and walk conn->lgr between the test and the lock - both of which smc_rx_pipe_buf_release() then dereferences, triggering use-after-free. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local user account with low privileges (PR:L per CVSS) on a Linux system where the SMC networking subsystem is active - SMC is not loaded by default on most general-purpose distributions and requires either InfiniBand/RoCE hardware and configuration (SMC-R) or SMC-D-capable shared-memory hardware. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects the local privilege-escalation potential, though the AC:L rating is arguably generous given that exploitation requires winning a timing race between two concurrent kernel paths - a constraint that CVSS guidelines typically map to AC:H. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to a patched stable kernel: 6.12.109, 6.18.50, or 7.2.4 as appropriate for the running stable series; mainline users should target 7.3-rc1 or apply the fix commits directly from git.kernel.org/stable (see references for all four commit URLs). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Linux systems running kernel versions from 4.18 through current stable branches to determine scope of exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today