CVE-2026-80982

The Linux kernel's SMC (Shared Memory Communications) protocol contains a use-after-free in smc_rx_pipe_buf_release(), triggered when a local, low-privileged user races a splice() read on an SMC socket against a concurrent close(). During the race, smc_conn_free() releases the connection's receive buffer and link group while smc_rx_update_cons() still dereferences conn->rmb_desc and walks conn->lgr (on the is_reg_err path, smcr_buf_unuse() frees the descriptor outright). The flaw is rated high severity (CVSS 3.1: 7.8) because successful exploitation of the freed kernel memory could enable privilege escalation, information disclosure, or a system crash. Any system running an affected kernel that supports and uses the SMC protocol — typically IBM Z (s390) and RDMA/RoCE enterprise deployments — is at risk, since exploitation requires only an existing local account. No public proof-of-concept exists, the issue is not in CISA's KEV catalog, and no in-the-wild exploitation is known. The fix takes the socket lock before checking a new conn->freed flag, ensuring the pipe-release and connection-teardown paths exclude each other.

What to do: Apply your distribution's kernel update as soon as it backports the smc_rx_pipe_buf_release() fix and reboot into the patched kernel. Check whether the smc module is loaded (lsmod | grep smc) or CONFIG_SMC is enabled on hosts; systems not using SMC can blacklist the module to eliminate the code path. Limit unprivileged local shell access on SMC-enabled servers, and watch for kernel oops/panic reports referencing smc_rx_pipe_buf_release or smc_conn_free as an indicator of attempted triggering.