EUVD-2026-76302
GHSA-3r27-v3q5-phcc
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition requires precise timing (AC:H); local low-priv access sufficient; no scope change; full impact if UAF is exploited successfully.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
net/smc: unregister the connection before draining the rx tasklet
smc_conn_free() calls smc_ism_unset_conn() only while the link group is still on its device list, and never sets conn->killed. smc_lgr_terminate_sched() unlinks the group immediately and defers killing its connections to a work item, so a connection freed in that window keeps its smcd->conn[] slot with both gates in smcd_handle_irq() open, and the device can re-arm the receive tasklet after tasklet_kill() has returned. On the DMB-nocopy path the ghost send buffer is freed right after that drain, so the re-armed tasklet dereferences it.
Unregister unconditionally and drain before the detach at both teardown sites, mirroring rmb_desc, which smc_buf_unuse() releases after the drain. Clear conn->sndbuf_desc before freeing it as well, so a reader that samples the pointer cannot get one that is already freed.
AnalysisAI
Use-after-free in the Linux kernel SMC (Shared Memory Communications) subsystem allows a low-privileged local attacker to trigger a race condition during connection teardown, resulting in memory corruption with potential for privilege escalation. The flaw exists in smc_conn_free() and smc_lgr_terminate_sched(): when a link group is unlinked before connection cleanup completes, the device can re-arm the receive tasklet after tasklet_kill() returns, causing the tasklet to dereference an already-freed send buffer on the DMB-nocopy path. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) local code execution with at minimum low-privileged (unprivileged) access on the target system; (2) the SMC kernel subsystem must be loaded and active - SMC is not enabled by default on most general-purpose Linux distributions and is primarily relevant to IBM Z/mainframe and ISM-capable hardware; (3) the attacker must be able to create and tear down SMC connections to trigger the specific race between smc_conn_free() and smc_lgr_terminate_sched(); (4) the DMB-nocopy path must be in use for the freed send buffer dereference to occur. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rates this as high-severity with full C/I/A impact, which is plausible for a kernel UAF enabling privilege escalation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update to a patched Linux kernel version: 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1, depending on the stable series in use. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux systems in your infrastructure and identify those running vulnerable kernel versions, prioritizing systems with untrusted user accounts or containerized workloads. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today