CVE-2026-64005: Linux Kernel SMC Hash Table Vulnerability

CVE-2026-64005 Overview

CVE-2026-64005 is a Linux kernel vulnerability in the Shared Memory Communications (SMC) protocol subsystem. The flaw resides in smc_init(), where INIT_HLIST_HEAD(&smc_v*_hashinfo.ht) calls execute after smc_nl_init(), proto_register(), and sock_register(). This ordering can reset SMC hashtables while entries already exist and are in use, resulting in a corrupted linked list. The corruption can lead to memory safety issues affecting confidentiality, integrity, and availability of the affected system.

Critical Impact
A local, low-privileged attacker able to trigger SMC socket operations during initialization can corrupt kernel hashtable state, potentially leading to memory corruption and denial of service on affected Linux systems.

Affected Products

Linux kernel versions containing the net/smc subsystem prior to the referenced stable patches
Distributions shipping kernels that include the pre-patch smc_init() ordering
Systems where the SMC protocol module is loaded or auto-loaded

Discovery Timeline

2026-07-19 - CVE-2026-64005 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64005

Vulnerability Analysis

The vulnerability affects the Linux kernel net/smc subsystem, which implements Shared Memory Communications over RDMA and TCP. During module initialization, smc_init() invokes smc_nl_init(), proto_register(), and sock_register() before calling INIT_HLIST_HEAD() on smc_v4_hashinfo.ht and smc_v6_hashinfo.ht. Once proto_register() and sock_register() complete, user space can create SMC sockets and insert entries into these hashtables. The subsequent INIT_HLIST_HEAD() calls then overwrite the hashtable head pointers, orphaning existing list entries and creating a corrupted list state.

Operating on a corrupted hlist can produce use-after-free conditions, null pointer dereferences, and arbitrary kernel memory writes when traversal or removal operations follow dangling pointers. This class of defect falls under kernel vulnerability and list corruption categories.

Root Cause

The root cause is incorrect initialization ordering in smc_init(). The hashtable heads are re-initialized after the SMC socket family has already been registered and made reachable from user space. Because static kernel data is zero-initialized at load time, the explicit INIT_HLIST_HEAD() calls are redundant and harmful in this position.

Attack Vector

Exploitation requires local access with the ability to create SMC sockets during the narrow window between socket registration and hashtable re-initialization, or to trigger scenarios where the corrupted list is traversed. The vulnerability is scored with a local attack vector, low attack complexity, and low privileges required.

The fix removes the unnecessary INIT_HLIST_HEAD() calls from smc_init() and adds HLIST_HEAD_INIT to the static definitions of smc_v4_hashinfo and smc_v6_hashinfo for clarity. See the upstream commits for implementation details, including Linux Kernel Commit ed7a758 and Linux Kernel Commit 0cc9d0a.

Detection Methods for CVE-2026-64005

Indicators of Compromise

Kernel oops or panic messages referencing smc_v4_hashinfo, smc_v6_hashinfo, or hlist traversal in the net/smc code path
Unexpected kernel warnings about list corruption (list_add corruption, hlist_del) originating from SMC functions
Repeated segfaults or hangs in processes creating AF_SMC sockets shortly after module load

Detection Strategies

Audit installed kernel versions against the fixed commits published on git.kernel.org for the stable trees
Monitor dmesg and /var/log/kern.log for SMC-related list corruption warnings and stack traces
Track loading of the smc kernel module on hosts that do not require SMC functionality

Monitoring Recommendations

Enable CONFIG_DEBUG_LIST on test and staging kernels to catch list corruption early
Alert on kernel crashes referencing net/smc/af_smc.c symbols in production telemetry
Inventory hosts with the SMC protocol enabled and prioritize them for patching

How to Mitigate CVE-2026-64005

Immediate Actions Required

Apply the upstream stable kernel patches referenced by the Linux kernel maintainers for the net/smc subsystem
Reboot affected hosts after installing the updated kernel package to load the fixed code
If patching is not immediately possible, blacklist the smc kernel module on systems that do not require SMC connectivity

Patch Information

The fix is available in multiple stable branches. Relevant commits include Linux Kernel Commit ed7a758, Linux Kernel Commit 55cba6b, Linux Kernel Commit 5ec9393, Linux Kernel Commit 64c96e4, Linux Kernel Commit 9e4389b, Linux Kernel Commit cdc79c0, Linux Kernel Commit 2006605, and Linux Kernel Commit 0cc9d0a. Consult the distribution security tracker for backported package versions.

Workarounds

Blacklist the smc module by adding blacklist smc to /etc/modprobe.d/ and rebuilding the initramfs
Restrict CAP_NET_RAW and socket creation privileges on multi-tenant hosts to reduce the local attack surface
Disable auto-loading of the SMC protocol family where SMC-R or SMC-D is not in use

bash

# Configuration example: prevent smc module from loading
echo 'blacklist smc' | sudo tee /etc/modprobe.d/disable-smc.conf
echo 'install smc /bin/true' | sudo tee -a /etc/modprobe.d/disable-smc.conf
sudo update-initramfs -u
sudo reboot