CVE-2026-23450 (GCVE-0-2026-23450)

Vulnerability from cvelistv5 – Published: 2026-04-03 15:15 – Updated: 2026-04-27 14:02
VLAI?
Title
net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()
Summary
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() Syzkaller reported a panic in smc_tcp_syn_recv_sock() [1]. smc_tcp_syn_recv_sock() is called in the TCP receive path (softirq) via icsk_af_ops->syn_recv_sock on the clcsock (TCP listening socket). It reads sk_user_data to get the smc_sock pointer. However, when the SMC listen socket is being closed concurrently, smc_close_active() sets clcsock->sk_user_data to NULL under sk_callback_lock, and then the smc_sock itself can be freed via sock_put() in smc_release(). This leads to two issues: 1) NULL pointer dereference: sk_user_data is NULL when accessed. 2) Use-after-free: sk_user_data is read as non-NULL, but the smc_sock is freed before its fields (e.g., queued_smc_hs, ori_af_ops) are accessed. The race window looks like this (the syzkaller crash [1] triggers via the SYN cookie path: tcp_get_cookie_sock() -> smc_tcp_syn_recv_sock(), but the normal tcp_check_req() path has the same race): CPU A (softirq) CPU B (process ctx) tcp_v4_rcv() TCP_NEW_SYN_RECV: sk = req->rsk_listener sock_hold(sk) /* No lock on listener */ smc_close_active(): write_lock_bh(cb_lock) sk_user_data = NULL write_unlock_bh(cb_lock) ... smc_clcsock_release() sock_put(smc->sk) x2 -> smc_sock freed! tcp_check_req() smc_tcp_syn_recv_sock(): smc = user_data(sk) -> NULL or dangling smc->queued_smc_hs -> crash! Note that the clcsock and smc_sock are two independent objects with separate refcounts. TCP stack holds a reference on the clcsock, which keeps it alive, but this does NOT prevent the smc_sock from being freed. Fix this by using RCU and refcount_inc_not_zero() to safely access smc_sock. Since smc_tcp_syn_recv_sock() is called in the TCP three-way handshake path, taking read_lock_bh on sk_callback_lock is too heavy and would not survive a SYN flood attack. Using rcu_read_lock() is much more lightweight. - Set SOCK_RCU_FREE on the SMC listen socket so that smc_sock freeing is deferred until after the RCU grace period. This guarantees the memory is still valid when accessed inside rcu_read_lock(). - Use rcu_read_lock() to protect reading sk_user_data. - Use refcount_inc_not_zero(&smc->sk.sk_refcnt) to pin the smc_sock. If the refcount has already reached zero (close path completed), it returns false and we bail out safely. Note: smc_hs_congested() has a similar lockless read of sk_user_data without rcu_read_lock(), but it only checks for NULL and accesses the global smc_hs_wq, never dereferencing any smc_sock field, so it is not affected. Reproducer was verified with mdelay injection and smc_run, the issue no longer occurs with this patch applied. [1] https://syzkaller.appspot.com/bug?extid=827ae2bfb3a3529333e9
Severity ?
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: ebfee3e153f67c8b38eb94a7062ee94aa6f92708 , < f315277856caeafcd996c2611afc085ca2d53275 (git)
Affected: 8270d9c21041470f58348248b9d9dcf3bf79592e , < 1e4f873879e075bbd4eb1c644d6933303ac5eba4 (git)
Affected: 8270d9c21041470f58348248b9d9dcf3bf79592e , < f00fc26c8a06442b225a350fe000c0a11483e6a3 (git)
Affected: 8270d9c21041470f58348248b9d9dcf3bf79592e , < cadf3da46c15523fba90d80c9955f536ee3b4023 (git)
Affected: 8270d9c21041470f58348248b9d9dcf3bf79592e , < fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2 (git)
Affected: 8270d9c21041470f58348248b9d9dcf3bf79592e , < 1fab5ece76fb42a761178dcd0ebcbf578377b0dd (git)
Affected: 8270d9c21041470f58348248b9d9dcf3bf79592e , < 6d5e4538364b9ceb1ac2941a4deb86650afb3538 (git)
Create a notification for this product.
    Linux Linux Affected: 5.18
Unaffected: 0 , < 5.18 (semver)
Unaffected: 5.15.203 , ≤ 5.15.* (semver)
Unaffected: 6.1.167 , ≤ 6.1.* (semver)
Unaffected: 6.6.130 , ≤ 6.6.* (semver)
Unaffected: 6.12.78 , ≤ 6.12.* (semver)
Unaffected: 6.18.20 , ≤ 6.18.* (semver)
Unaffected: 6.19.10 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/smc/af_smc.c",
            "net/smc/smc.h",
            "net/smc/smc_close.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f315277856caeafcd996c2611afc085ca2d53275",
              "status": "affected",
              "version": "ebfee3e153f67c8b38eb94a7062ee94aa6f92708",
              "versionType": "git"
            },
            {
              "lessThan": "1e4f873879e075bbd4eb1c644d6933303ac5eba4",
              "status": "affected",
              "version": "8270d9c21041470f58348248b9d9dcf3bf79592e",
              "versionType": "git"
            },
            {
              "lessThan": "f00fc26c8a06442b225a350fe000c0a11483e6a3",
              "status": "affected",
              "version": "8270d9c21041470f58348248b9d9dcf3bf79592e",
              "versionType": "git"
            },
            {
              "lessThan": "cadf3da46c15523fba90d80c9955f536ee3b4023",
              "status": "affected",
              "version": "8270d9c21041470f58348248b9d9dcf3bf79592e",
              "versionType": "git"
            },
            {
              "lessThan": "fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2",
              "status": "affected",
              "version": "8270d9c21041470f58348248b9d9dcf3bf79592e",
              "versionType": "git"
            },
            {
              "lessThan": "1fab5ece76fb42a761178dcd0ebcbf578377b0dd",
              "status": "affected",
              "version": "8270d9c21041470f58348248b9d9dcf3bf79592e",
              "versionType": "git"
            },
            {
              "lessThan": "6d5e4538364b9ceb1ac2941a4deb86650afb3538",
              "status": "affected",
              "version": "8270d9c21041470f58348248b9d9dcf3bf79592e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/smc/af_smc.c",
            "net/smc/smc.h",
            "net/smc/smc_close.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.18"
            },
            {
              "lessThan": "5.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.167",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.130",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.78",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.20",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "5.15.174",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.167",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.130",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.78",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.20",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.10",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()\n\nSyzkaller reported a panic in smc_tcp_syn_recv_sock() [1].\n\nsmc_tcp_syn_recv_sock() is called in the TCP receive path\n(softirq) via icsk_af_ops-\u003esyn_recv_sock on the clcsock (TCP\nlistening socket). It reads sk_user_data to get the smc_sock\npointer. However, when the SMC listen socket is being closed\nconcurrently, smc_close_active() sets clcsock-\u003esk_user_data\nto NULL under sk_callback_lock, and then the smc_sock itself\ncan be freed via sock_put() in smc_release().\n\nThis leads to two issues:\n\n1) NULL pointer dereference: sk_user_data is NULL when\n   accessed.\n2) Use-after-free: sk_user_data is read as non-NULL, but the\n   smc_sock is freed before its fields (e.g., queued_smc_hs,\n   ori_af_ops) are accessed.\n\nThe race window looks like this (the syzkaller crash [1]\ntriggers via the SYN cookie path: tcp_get_cookie_sock() -\u003e\nsmc_tcp_syn_recv_sock(), but the normal tcp_check_req() path\nhas the same race):\n\n  CPU A (softirq)              CPU B (process ctx)\n\n  tcp_v4_rcv()\n    TCP_NEW_SYN_RECV:\n    sk = req-\u003ersk_listener\n    sock_hold(sk)\n    /* No lock on listener */\n                               smc_close_active():\n                                 write_lock_bh(cb_lock)\n                                 sk_user_data = NULL\n                                 write_unlock_bh(cb_lock)\n                                 ...\n                                 smc_clcsock_release()\n                                 sock_put(smc-\u003esk) x2\n                                   -\u003e smc_sock freed!\n    tcp_check_req()\n      smc_tcp_syn_recv_sock():\n        smc = user_data(sk)\n          -\u003e NULL or dangling\n        smc-\u003equeued_smc_hs\n          -\u003e crash!\n\nNote that the clcsock and smc_sock are two independent objects\nwith separate refcounts. TCP stack holds a reference on the\nclcsock, which keeps it alive, but this does NOT prevent the\nsmc_sock from being freed.\n\nFix this by using RCU and refcount_inc_not_zero() to safely\naccess smc_sock. Since smc_tcp_syn_recv_sock() is called in\nthe TCP three-way handshake path, taking read_lock_bh on\nsk_callback_lock is too heavy and would not survive a SYN\nflood attack. Using rcu_read_lock() is much more lightweight.\n\n- Set SOCK_RCU_FREE on the SMC listen socket so that\n  smc_sock freeing is deferred until after the RCU grace\n  period. This guarantees the memory is still valid when\n  accessed inside rcu_read_lock().\n- Use rcu_read_lock() to protect reading sk_user_data.\n- Use refcount_inc_not_zero(\u0026smc-\u003esk.sk_refcnt) to pin the\n  smc_sock. If the refcount has already reached zero (close\n  path completed), it returns false and we bail out safely.\n\nNote: smc_hs_congested() has a similar lockless read of\nsk_user_data without rcu_read_lock(), but it only checks for\nNULL and accesses the global smc_hs_wq, never dereferencing\nany smc_sock field, so it is not affected.\n\nReproducer was verified with mdelay injection and smc_run,\nthe issue no longer occurs with this patch applied.\n\n[1] https://syzkaller.appspot.com/bug?extid=827ae2bfb3a3529333e9"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-27T14:02:29.638Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275"
        },
        {
          "url": "https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4"
        },
        {
          "url": "https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2"
        },
        {
          "url": "https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538"
        }
      ],
      "title": "net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23450",
    "datePublished": "2026-04-03T15:15:33.144Z",
    "dateReserved": "2026-01-13T15:37:46.020Z",
    "dateUpdated": "2026-04-27T14:02:29.638Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23450",
      "date": "2026-05-07",
      "epss": "0.00078",
      "percentile": "0.23008"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23450\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-04-03T16:16:31.243\",\"lastModified\":\"2026-04-27T14:16:33.563\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock()\\n\\nSyzkaller reported a panic in smc_tcp_syn_recv_sock() [1].\\n\\nsmc_tcp_syn_recv_sock() is called in the TCP receive path\\n(softirq) via icsk_af_ops-\u003esyn_recv_sock on the clcsock (TCP\\nlistening socket). It reads sk_user_data to get the smc_sock\\npointer. However, when the SMC listen socket is being closed\\nconcurrently, smc_close_active() sets clcsock-\u003esk_user_data\\nto NULL under sk_callback_lock, and then the smc_sock itself\\ncan be freed via sock_put() in smc_release().\\n\\nThis leads to two issues:\\n\\n1) NULL pointer dereference: sk_user_data is NULL when\\n   accessed.\\n2) Use-after-free: sk_user_data is read as non-NULL, but the\\n   smc_sock is freed before its fields (e.g., queued_smc_hs,\\n   ori_af_ops) are accessed.\\n\\nThe race window looks like this (the syzkaller crash [1]\\ntriggers via the SYN cookie path: tcp_get_cookie_sock() -\u003e\\nsmc_tcp_syn_recv_sock(), but the normal tcp_check_req() path\\nhas the same race):\\n\\n  CPU A (softirq)              CPU B (process ctx)\\n\\n  tcp_v4_rcv()\\n    TCP_NEW_SYN_RECV:\\n    sk = req-\u003ersk_listener\\n    sock_hold(sk)\\n    /* No lock on listener */\\n                               smc_close_active():\\n                                 write_lock_bh(cb_lock)\\n                                 sk_user_data = NULL\\n                                 write_unlock_bh(cb_lock)\\n                                 ...\\n                                 smc_clcsock_release()\\n                                 sock_put(smc-\u003esk) x2\\n                                   -\u003e smc_sock freed!\\n    tcp_check_req()\\n      smc_tcp_syn_recv_sock():\\n        smc = user_data(sk)\\n          -\u003e NULL or dangling\\n        smc-\u003equeued_smc_hs\\n          -\u003e crash!\\n\\nNote that the clcsock and smc_sock are two independent objects\\nwith separate refcounts. TCP stack holds a reference on the\\nclcsock, which keeps it alive, but this does NOT prevent the\\nsmc_sock from being freed.\\n\\nFix this by using RCU and refcount_inc_not_zero() to safely\\naccess smc_sock. Since smc_tcp_syn_recv_sock() is called in\\nthe TCP three-way handshake path, taking read_lock_bh on\\nsk_callback_lock is too heavy and would not survive a SYN\\nflood attack. Using rcu_read_lock() is much more lightweight.\\n\\n- Set SOCK_RCU_FREE on the SMC listen socket so that\\n  smc_sock freeing is deferred until after the RCU grace\\n  period. This guarantees the memory is still valid when\\n  accessed inside rcu_read_lock().\\n- Use rcu_read_lock() to protect reading sk_user_data.\\n- Use refcount_inc_not_zero(\u0026smc-\u003esk.sk_refcnt) to pin the\\n  smc_sock. If the refcount has already reached zero (close\\n  path completed), it returns false and we bail out safely.\\n\\nNote: smc_hs_congested() has a similar lockless read of\\nsk_user_data without rcu_read_lock(), but it only checks for\\nNULL and accesses the global smc_hs_wq, never dereferencing\\nany smc_sock field, so it is not affected.\\n\\nReproducer was verified with mdelay injection and smc_run,\\nthe issue no longer occurs with this patch applied.\\n\\n[1] https://syzkaller.appspot.com/bug?extid=827ae2bfb3a3529333e9\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f315277856caeafcd996c2611afc085ca2d53275\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.