{ "schema_version": "1.6.1", "id": "RPI-CVE-2026-23450", "modified": "2026-10-09T11:39:44Z", "upstream": [ "CVE-2026-23450" ], "published": "2026-04-03T15:24:34Z", "summary": "net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()\n\nSyzkaller reported a panic in smc_tcp_syn_recv_sock() [1].\n\nsmc_tcp_syn_recv_sock() is called in the TCP receive path\n(softirq) via icsk_af_ops->syn_recv_sock on the clcsock (TCP\nlistening socket). It reads sk_user_data to get the smc_sock\npointer. However, when the SMC listen socket is being closed\nconcurrently, smc_close_active() sets clcsock->sk_user_data\nto NULL under sk_callback_lock, and then the smc_sock itself\ncan be freed via sock_put() in smc_release().\n\nThis leads to two issues:\n\n1) NULL pointer dereference: sk_user_data is NULL when\n accessed.\n2) Use-after-free: sk_user_data is read as non-NULL, but the\n smc_sock is freed before its fields (e.g., queued_smc_hs,\n ori_af_ops) are accessed.\n\nThe race window looks like this (the syzkaller crash [1]\ntriggers via the SYN cookie path: tcp_get_cookie_sock() ->\nsmc_tcp_syn_recv_sock(), but the normal tcp_check_req() path\nhas the same race):\n\n CPU A (softirq) CPU B (process ctx)\n\n tcp_v4_rcv()\n TCP_NEW_SYN_RECV:\n sk = req->rsk_listener\n sock_hold(sk)\n /* No lock on listener */\n smc_close_active():\n write_lock_bh(cb_lock)\n sk_user_data = NULL\n write_unlock_bh(cb_lock)\n ...\n smc_clcsock_release()\n sock_put(smc->sk) x2\n -> smc_sock freed!\n tcp_check_req()\n smc_tcp_syn_recv_sock():\n smc = user_data(sk)\n -> NULL or dangling\n smc->queued_smc_hs\n -> crash!\n\nNote that the clcsock and smc_sock are two independent objects\nwith separate refcounts. TCP stack holds a reference on the\nclcsock, which keeps it alive, but this does NOT prevent the\nsmc_sock from being freed.\n\nFix this by using RCU and refcount_inc_not_zero() to safely\naccess smc_sock. Since smc_tcp_syn_recv_sock() is called in\nthe TCP three-way handshake path, taking read_lock_bh on\nsk_callback_lock is too heavy and would not survive a SYN\nflood attack. Using rcu_read_lock() is much more lightweight.\n\n- Set SOCK_RCU_FREE on the SMC listen socket so that\n smc_sock freeing is deferred until after the RCU grace\n period. This guarantees the memory is still valid when\n accessed inside rcu_read_lock().\n- Use rcu_read_lock() to protect reading sk_user_data.\n- Use refcount_inc_not_zero(&smc->sk.sk_refcnt) to pin the\n smc_sock. If the refcount has already reached zero (close\n path completed), it returns false and we bail out safely.\n\nNote: smc_hs_congested() has a similar lockless read of\nsk_user_data without rcu_read_lock(), but it only checks for\nNULL and accesses the global smc_hs_wq, never dereferencing\nany smc_sock field, so it is not affected.\n\nReproducer was verified with mdelay injection and smc_run,\nthe issue no longer occurs with this patch applied.\n\n[1] https://syzkaller.appspot.com/bug?extid=827ae2bfb3a3529333e9", "severity": [ { "type": "CVSS_V3", "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H" } ], "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:12", "name": "linux" }, "versions": [ "1:6.1.47-1+rpt4" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.1.0-rpi3-rpi-2712", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v6", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v7", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v8", "binary_version": "1:6.1.47-1+rpt4" } ] }, "database_specific": { "per_version": { "1:6.1.47-1+rpt4": { "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e", "upstream_version": "6.1.47", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.1.167", "compiled_filter": false } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2026-23450" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-08-05T13:16:28Z", "severity": { "source": "kernel CNA", "cvss_v3_score": 9.8, "cvss_v3_severity": "Critical", "scenario": "AV:N - The vulnerable callback is invoked from the TCP receive path via tcp_check_req() or tcp_get_cookie_sock() for packets hitting an SMC listening socket. A remote peer can reach this pre-authentication code by completing or racing TCP handshakes to the exposed listener.\nAC:L - The trigger is a close-vs-handshake race, but the attacker can drive the packet side repeatedly with concurrent connection attempts and SYN-cookie/normal ACK paths. There is no rare memory layout, special authentication state, or non-default runtime condition required beyond an enabled SMC listener.\nPR:N - No kernel capability, local account, or SMC protocol authentication is checked before smc_tcp_syn_recv_sock() dereferences sk_user_data. The network peer reaches the vulnerable path before accept-time SMC CLC processing.\nUI:N - Exploitation does not require a victim user action once an SMC listener is present. Incoming network traffic and concurrent listener teardown are sufficient to hit the vulnerable path.\nS:U - The bug corrupts or crashes kernel state within the same host security authority. It is not a VM escape, IOMMU bypass, or cross-scope boundary violation.\nC:H - The fix addresses a real use-after-free of struct smc_sock, not only a NULL dereference. Under the required kernel guidance, UAF is treated as enabling high confidentiality impact through potential reuse and disclosure primitives.\nI:H - The dangling smc_sock is dereferenced for fields including queued_smc_hs and ori_af_ops, and UAF of kernel heap objects can be shaped into control-flow or write primitives. Under the required kernel guidance, UAF warrants high integrity impact.\nA:H - The observed failure is a KASAN NULL dereference/oops in smc_tcp_syn_recv_sock(), and the UAF path can also crash the kernel. Kernel oops or panic is high availability impact." } } }