CVE-2026-46330 (GCVE-0-2026-46330)

Vulnerability from cvelistv5 – Published: 2026-06-09 12:25 – Updated: 2026-08-05 12:31
VLAI
Title
Revert "net/smc: Introduce TCP ULP support"
Summary
In the Linux kernel, the following vulnerability has been resolved: Revert "net/smc: Introduce TCP ULP support" This reverts commit d7cd421da9da2cc7b4d25b8537f66db5c8331c40. As reported by Al Viro, the TCP ULP support for SMC is fundamentally broken. The implementation attempts to convert an active TCP socket into an SMC socket by modifying the underlying `struct file`, dentry, and inode in-place, which violates core VFS invariants that assume these structures are immutable for an open file, creating a risk of use after free errors and general system instability. Given the severity of this design flaw and the fact that cleaner alternatives (e.g., LD_PRELOAD, BPF) exist for legacy application transparency, the correct course of action is to remove this feature entirely.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: d7cd421da9da2cc7b4d25b8537f66db5c8331c40 , < 6c505d95c69e27dbf28fea29dc84d2498d69515c (git)
Affected: d7cd421da9da2cc7b4d25b8537f66db5c8331c40 , < df31a6b0a3057e66994ad6ccf5d95b9b9514f033 (git)
Create a notification for this product.
Linux Linux Affected: 5.17
Unaffected: 0 , < 5.17 (semver)
Unaffected: 6.19.4 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/smc/af_smc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "6c505d95c69e27dbf28fea29dc84d2498d69515c",
              "status": "affected",
              "version": "d7cd421da9da2cc7b4d25b8537f66db5c8331c40",
              "versionType": "git"
            },
            {
              "lessThan": "df31a6b0a3057e66994ad6ccf5d95b9b9514f033",
              "status": "affected",
              "version": "d7cd421da9da2cc7b4d25b8537f66db5c8331c40",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/smc/af_smc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.17"
            },
            {
              "lessThan": "5.17",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.17",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRevert \"net/smc: Introduce TCP ULP support\"\n\nThis reverts commit d7cd421da9da2cc7b4d25b8537f66db5c8331c40.\n\nAs reported by Al Viro, the TCP ULP support for SMC is fundamentally\nbroken. The implementation attempts to convert an active TCP socket\ninto an SMC socket by modifying the underlying `struct file`, dentry,\nand inode in-place, which violates core VFS invariants that assume\nthese structures are immutable for an open file, creating a risk of\nuse after free errors and general system instability.\n\nGiven the severity of this design flaw and the fact that cleaner\nalternatives (e.g., LD_PRELOAD, BPF) exist for legacy application\ntransparency, the correct course of action is to remove this feature\nentirely."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable code is reached only via the local setsockopt(TCP_ULP, \"smc\") syscall on a TCP socket owned by the caller; smc_ulp_init() is not invoked from packet receive or any remote network path. The bug is triggered exclusively through the setsockopt(2) syscall on a TCP socket owned by the attacker; smc_ulp_init() is registered as a TCP ULP handler and is invoked from do_tcp_setsockopt() \u2192 tcp_set_ulp(), not from any network packet-receive or remote protocol path.\nAC:L - On systems with CONFIG_SMC enabled, an attacker fully controls socket creation, the pre-connect setsockopt call, and subsequent close/dup/fork races needed to trigger the corrupted VFS state and resulting UAF. An attacker fully controls socket creation, the setsockopt(TCP_ULP, \"smc\") call, and subsequent lifecycle operations (close, dup, connect); once preconditions are met the VFS corruption in smc_ulp_init() is deterministic and UAF/double-free can be provoked on demand without conditions outside attacker control.\nPR:L - Any unprivileged local user who can open a TCP socket may call setsockopt(TCP_ULP); module autoload uses CAP_NET_ADMIN which is obtainable in user namespaces, and no real-root capability is required when SMC is already loaded. No real-root capability is required\u2014any unprivileged local user who can create a SOCK_STREAM TCP socket and call setsockopt on it can reach smc_ulp_init(), including via user namespaces; TCP_ULP has no CAP_NET_ADMIN gate (unlike TCP congestion control), and module autoload is only needed if SMC is not already loaded.\nUI:N - Exploitation requires no action from another user or administrator; the attacker triggers the bug directly through their own socket file descriptor. Exploitation requires no action from a victim user; a local attacker can open a socket, invoke setsockopt(TCP_ULP, \"smc\"), and trigger the corrupted VFS state through normal close/dup operations in their own process.\nS:U - Impact is confined to kernel memory corruption and privilege escalation within the same kernel security boundary, not a cross-boundary escape such as guest-to-host or IOMMU bypass. Impact is confined to kernel memory corruption and privilege escalation within the same kernel security authority; this is not a VM escape, IOMMU bypass, or cross-security-boundary escape.\nC:H - The in-place swapping of file, dentry, and inode pointers breaks VFS lifetime invariants and creates use-after-free conditions that can be leveraged for arbitrary kernel memory disclosure. The in-place swapping of file, dentry, and inode pointers breaks VFS lifetime invariants and creates use-after-free conditions that can be leveraged for arbitrary kernel memory disclosure. The fix commit and Al Viro\u0027s report explicitly identify use-after-free risk from in-place modification of struct file, dentry, and inode on an open file descriptor, which can yield arbitrary kernel memory read primitives through corrupted inode/file reference counting.\nI:H - UAF and broken VFS reference counting on live file descriptors enable heap grooming and arbitrary kernel write/control-flow hijacking, not merely a bounded or cosmetic corruption.\nA:H - The design flaw causes use-after-free, double-free, and general system instability during file close/__fput paths, readily producing kernel oops/panic and complete denial of service on affected IBM Z/RoCE systems running SMC."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:31:24.893Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/6c505d95c69e27dbf28fea29dc84d2498d69515c"
        },
        {
          "url": "https://git.kernel.org/stable/c/df31a6b0a3057e66994ad6ccf5d95b9b9514f033"
        }
      ],
      "title": "Revert \"net/smc: Introduce TCP ULP support\"",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46330",
    "datePublished": "2026-06-09T12:25:59.413Z",
    "dateReserved": "2026-05-13T15:03:33.112Z",
    "dateUpdated": "2026-08-05T12:31:24.893Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-46330",
      "date": "2026-08-07",
      "epss": "0.00112",
      "percentile": "0.01591"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-12T14:55:59.000Z",
      "cve": "CVE-2026-46330",
      "id": "msrc_CVE-2026-46330",
      "initial_release_date": "2026-06-02T00:00:00.000Z",
      "product_status:known_affected": "4",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "Revert \"net/smc: Introduce TCP ULP support\"",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-46330.json",
      "version": "4"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-46330\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-06-09T14:16:42.723\",\"lastModified\":\"2026-07-23T08:10:00.137\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRevert \\\"net/smc: Introduce TCP ULP support\\\"\\n\\nThis reverts commit d7cd421da9da2cc7b4d25b8537f66db5c8331c40.\\n\\nAs reported by Al Viro, the TCP ULP support for SMC is fundamentally\\nbroken. The implementation attempts to convert an active TCP socket\\ninto an SMC socket by modifying the underlying `struct file`, dentry,\\nand inode in-place, which violates core VFS invariants that assume\\nthese structures are immutable for an open file, creating a risk of\\nuse after free errors and general system instability.\\n\\nGiven the severity of this design flaw and the fact that cleaner\\nalternatives (e.g., LD_PRELOAD, BPF) exist for legacy application\\ntransparency, the correct course of action is to remove this feature\\nentirely.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\\n\\nRevertir  net/smc: Introduce TCP ULP support \\n\\nEsto revierte el commit d7cd421da9da2cc7b4d25b8537f66db5c8331c40.\\n\\nSeg\u00fan lo informado por Al Viro, el soporte TCP ULP para SMC est\u00e1 fundamentalmente roto. La implementaci\u00f3n intenta convertir un socket TCP activo en un socket SMC modificando in situ la \u0027struct file\u0027, dentry e inode subyacentes, lo que viola las invariantes centrales de VFS que asumen que estas estructuras son inmutables para un archivo abierto, creando un riesgo de errores de uso despu\u00e9s de liberar (use after free) e inestabilidad general del sistema.\\n\\nDada la gravedad de este defecto de dise\u00f1o y el hecho de que existen alternativas m\u00e1s limpias (p. ej., LD_PRELOAD, BPF) para la transparencia de aplicaciones heredadas, el curso de acci\u00f3n correcto es eliminar esta caracter\u00edstica por completo.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/smc/af_smc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"d7cd421da9da2cc7b4d25b8537f66db5c8331c40\",\"lessThan\":\"6c505d95c69e27dbf28fea29dc84d2498d69515c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"d7cd421da9da2cc7b4d25b8537f66db5c8331c40\",\"lessThan\":\"df31a6b0a3057e66994ad6ccf5d95b9b9514f033\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/smc/af_smc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.17\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.17\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.4\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.17\",\"versionEndExcluding\":\"6.19.4\",\"matchCriteriaId\":\"7364BC6F-BA7F-41F3-98E5-584998F67723\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/6c505d95c69e27dbf28fea29dc84d2498d69515c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/df31a6b0a3057e66994ad6ccf5d95b9b9514f033\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T14:40:25+00:00",
      "cve": "CVE-2026-46330",
      "id": "CVE-2026-46330",
      "initial_release_date": "2026-06-09T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Revert \"net/smc: Introduce TCP ULP support\"",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46330.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.