CVE-2026-46027: Linux Kernel SMC Link Group Vulnerability

CVE-2026-46027 Overview

CVE-2026-46027 is a Linux kernel vulnerability in the Shared Memory Communications (SMC) protocol stack. The flaw resides in the smc_clc_wait_msg() function within net/smc. A Connection Layer Control (CLC) decline message can arrive while the handshake is still in an early stage, before the connection has been associated with a link group.

The decline handler updates link-group level sync state for first-contact declines, but that state only exists after link group setup completes. Accessing the link group structure before initialization can lead to undefined kernel behavior in the SMC protocol path.

Critical Impact
Early access to uninitialized link group state in the SMC handshake path can cause kernel instability when processing CLC decline messages from peers.

Affected Products

Linux kernel net/smc subsystem (SMC protocol implementation)
Multiple stable Linux kernel branches receiving the backported fix
Systems using SMC-R or SMC-D for accelerated TCP socket communications

Discovery Timeline

2026-05-27 - CVE-2026-46027 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46027

Vulnerability Analysis

The Shared Memory Communications (SMC) protocol provides RDMA-accelerated TCP socket semantics in the Linux kernel. During connection establishment, peers exchange CLC (Connection Layer Control) messages to negotiate parameters and associate the new connection with a link group.

The vulnerability stems from a sequencing assumption in smc_clc_wait_msg(). The function processes incoming CLC decline messages and updates link-group level synchronization state for first-contact declines. However, a CLC decline can be received before link group setup has completed.

When the decline arrives during this early window, the link group structure that the handler attempts to update does not yet exist for the connection. The code path touches link-group state that is not yet available, producing an inconsistent state in the SMC handshake logic.

Root Cause

The root cause is missing validation that the connection has been bound to a link group before updating link-group sync state in the CLC decline path. The handler conflated per-socket peer diagnosis handling with link-group level state updates, applying both unconditionally on receipt of a decline message.

Attack Vector

The vulnerable code path is reached when a peer sends a CLC decline during the early phase of an SMC handshake. The fix guards the link-group update so it only runs when the link group has been established, while preserving the existing per-socket peer diagnosis handling. The patch retains sync_err handling for established link-group contexts and avoids touching link-group state before it is available.

Verified fix commits are published in the upstream stable tree, including 5a8db80f721d, 6180a296ca65, 83bcf9228b05, ea0b5d0fe963, and f0858e1d5624. See the Linux Kernel commit for the canonical change.

Detection Methods for CVE-2026-46027

Indicators of Compromise

Kernel warnings, oops messages, or unexpected behavior originating from the net/smc subsystem during SMC connection setup
Anomalous CLC decline messages received during early handshake stages on hosts using SMC-R or SMC-D
Instability or crashes on systems that load the smc kernel module and accept inbound SMC connections

Detection Strategies

Inventory Linux hosts loading the smc kernel module and compare running kernel versions against the patched stable branches
Monitor dmesg and journal output for entries referencing smc_clc_wait_msg or SMC link group errors
Audit network exposure of SMC services on hosts with RDMA-capable network adapters

Monitoring Recommendations

Forward kernel logs to a centralized logging or SIEM platform and alert on net/smc warnings and call traces
Track kernel package versions across the fleet and flag hosts running pre-patch kernels with SMC enabled
Review SMC protocol usage patterns and restrict acceptance of SMC connections to trusted network segments

How to Mitigate CVE-2026-46027

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits as soon as your distribution publishes updated kernel packages
Identify hosts that use SMC-R or SMC-D and prioritize them for patching, since the vulnerable code path is in the SMC handshake handler
If patching cannot be completed immediately, disable or unload the smc kernel module on hosts that do not require it

Patch Information

The fix guards the link-group update in smc_clc_wait_msg() so it only executes when the link group has been established. Per-socket peer diagnosis handling remains unchanged, and sync_err handling for established link-group contexts is preserved. Patches have been merged into multiple stable kernel branches; refer to the commits 5a8db80f721d, 6180a296ca65, 83bcf9228b05, ea0b5d0fe963, and f0858e1d5624 in the Linux stable tree.

Workarounds

Blacklist the smc module on systems that do not require Shared Memory Communications: add blacklist smc to a file under /etc/modprobe.d/ and rebuild the initramfs
Restrict inbound SMC traffic at the network layer to trusted hosts only, reducing exposure to malicious CLC decline messages
Where SMC is required, schedule maintenance windows to install the patched kernel and reboot affected systems

bash

# Disable the SMC module on systems that do not require it
echo 'blacklist smc' | sudo tee /etc/modprobe.d/disable-smc.conf
sudo rmmod smc 2>/dev/null || true

# Verify the module is not loaded
lsmod | grep -i smc

# Check current running kernel version against patched releases
uname -r