CVE-2026-80980

The Linux kernel's SMC (Shared Memory Communications, SMC-R/SMC-D) implementation packs three one-bit connection state flags — killed, freed, and out_of_sync — into a single byte of struct smc_connection, and they are written from different execution contexts without a common lock (out_of_sync from the receive tasklet in smc_cdc_msg_validate(), killed from process context under lock_sock() in smc_conn_kill()). Each store is a non-atomic read-modify-write of the shared byte, so concurrent updates can silently clobber each other — for example, a connection that was just killed or freed can lose that flag and continue to be used, with the potential for use-after-free and kernel memory corruption. Triggering the race requires being able to exchange SMC CDC traffic with a victim, so the attacker must effectively be a peer or on the path of an established SMC connection rather than an arbitrary internet host. The issue is scored 9.8 critical (network vector, no privileges, no user interaction), but real-world exposure is confined to systems actively using SMC, which is dominated by IBM Z/LinuxONE deployments with RDMA (RoCE/ISM) links; the vast majority of Linux hosts never use AF_SMC sockets. No public proof of concept is known, the flaw is not in CISA's KEV catalog, and no exploitation has been observed.

What to do: Apply the upstream kernel fix, which gives each flag its own byte in struct smc_connection (struct grows by two bytes), as soon as your distribution ships it; there is no configuration-only workaround because the race is inherent to the data layout. If SMC is not needed on a host, reduce exposure by preventing the smc module from loading (e.g., module blacklist) and confirming it is not loaded via 'lsmod | grep smc' or by checking for AF_SMC sockets. For SMC-enabled systems (mainly IBM Z with RoCE/ISM), restrict SMC peering to trusted networks and hosts, since exploitation requires the ability to send CDC messages on an SMC connection; monitor kernel logs for smc connection teardown anomalies or crashes that could indicate an attempted trigger.