Linux kernel EUVD-2026-108827

Requires: (1) local access to the host and the ability to create AF_SMC sockets, which in turn requires the kernel to be built/loaded with SMC support (CONFIG_SMC) and typically SMC connectivity in use - not a default on most general-purpose distributions; (2) an established SMC socket whose link group is terminated (reachable via shutdown(SHUT_WR) driving smc_close_active_abort() / smc_clcsock_release()); and (3) winning a timing race between a getsockname()/getpeername() call and the termination worker that clears and frees smc->clcsock. LIMITING FACTORS: the vector is local-only (no network reachability), the SMC subsystem must be enabled and exercised (a significant filter, as most deployments never use SMC), and the race window is tight - KASAN required added timing instrumentation to hit it, so reliable exploitation against an unmodified kernel is non-trivial. Authentication: CVSS PR:L indicates a low-privilege (authenticated/local-user) requirement, not unauthenticated remote access.

Signals diverge, and the honest read is high-severity-but-constrained risk. The input CVSS of 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is driven by local access with full CIA impact, but every real-world amplifier is low: EPSS is 0.21% (11th percentile), the CVE is NOT in CISA KEV, and no public exploit or PoC reference is present in the input (only kernel.org stable patch commits). The vuln.today decision label is 'this_week', consistent with a patch-promptly-but-not-emergency posture rather than act_now. Two tensions should be flagged explicitly: (1) the vector is AV:L (local only) - this is not remotely reachable, so exposure is limited to attackers who already have the ability to run code and open AF_SMC sockets on the host; (2) the CVSS claims I:H and A:H, but the described mechanism is a use-after-free READ in smc_getname() (an 8-byte load of freed clcsock) plus a possible NULL dereference, which maps cleanly to information disclosure and denial-of-service (crash) but weakly to integrity - the Tags even label this 'Information Disclosure', so the input's I:H appears overstated versus the described primitive. Additionally, exploitation requires winning a race: KASAN only reproduced this 'with test-only timing instrumentation', indicating a tight window. Net: a legitimate kernel bug worth patching on a normal cadence, not a widespread-exploitation emergency.

A local unprivileged user on a host with SMC (AF_SMC) sockets in use opens an SMC connection, triggers link-group termination (e.g. via shutdown(SHUT_WR) leading to smc_close_active_abort()), and concurrently calls getsockname() on the socket, racing the termination worker that releases the CLC socket. If the worker frees clcsock after the syscall loads the pointer, the getname path reads freed slab memory (use-after-free, potential kernel info leak); if it clears the pointer first, the result is a NULL dereference and crash (DoS). No public exploit is identified; the reporter used a KASAN-instrumented reproducer, not a published tool.