CVE-2026-64048: Linux Kernel Privilege Escalation Flaw

CVE-2026-64048 Overview

CVE-2026-64048 is a null pointer dereference vulnerability in the Linux kernel's Shared Memory Communications - Direct (SMC-D) client subsystem. The flaw resides in smc_v2_determine_accepted_chid() within net/smc/, where the function matches a peer's Coalition ID (CHID) against ini->ism_dev[] starting at index 0. Slot 0 is reserved for SMC-Dv1 devices and remains NULL when no v1 device is selected. A malicious remote peer that responds to an SMC-Dv2-only proposal with d1.chid == 0 matches the empty slot, causing ism_dev[0]->lgr_lock to dereference a null pointer in smc_conn_create().

Critical Impact
A remote attacker can trigger a kernel null pointer dereference over the network, causing a kernel panic and denial of service on systems using SMC-D client connections.

Affected Products

Linux kernel builds with CONFIG_SMC enabled and SMC-D client functionality active
Systems using IBM Internal Shared Memory (ISM) devices with SMC-Dv2 negotiation
Distributions shipping affected upstream kernels prior to the fix commits

Discovery Timeline

2026-07-19 - CVE-2026-64048 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64048

Vulnerability Analysis

The SMC-D protocol enables high-throughput socket communications between LPARs using IBM ISM devices. On the client side, the kernel maintains parallel arrays ini->ism_dev[] and ini->ism_chid[] to track candidate devices during connection negotiation. Slot 0 is reserved for a legacy SMC-Dv1 device, while smc_find_ism_v2_device_clnt() populates SMC-Dv2 entries beginning at index 1.

When no v1 device is selected, slot 0 retains its kzalloc() initialized state: ism_dev[0] == NULL and ism_chid[0] == 0. The function smc_v2_determine_accepted_chid() iterates from index 0 and compares only the CHID value. A peer replying with d1.chid == 0 matches the empty slot, setting ini->ism_selected = 0. The subsequent code path in smc_conn_create() dereferences ism_dev[0]->lgr_lock at offset 0x68 and faults.

Root Cause

The root cause is missing validation of the ism_dev[i] pointer before accepting a CHID match. The comparison logic trusts an attacker-controlled CHID value without verifying that the corresponding device slot references a valid smcd_dev structure. This is a classic null pointer dereference driven by insufficient input validation of remote protocol data.

Attack Vector

Exploitation requires a malicious SMC peer capable of responding to an SMC-Dv2 CLC proposal from the victim. The attacker crafts an ACCEPT message where the first device CHID field (d1.chid) equals 0. When the victim client processes the reply, smc_v2_determine_accepted_chid() matches the empty reserved slot and the kernel writes to address 0x68, generating a KASAN report:

BUG: KASAN: null-ptr-deref in _raw_spin_lock_bh+0x79/0xe0
Write of size 4 at addr 0000000000000068 by task exploit/144
Call Trace:
 _raw_spin_lock_bh
 smc_conn_create (net/smc/smc_core.c:1997)
 __smc_connect (net/smc/af_smc.c:1447)
 smc_connect (net/smc/af_smc.c:1720)
 __sys_connect
 __x64_sys_connect
 do_syscall_64

The upstream fix requires ism_dev[i] to be non-NULL before accepting any CHID match, closing the null-slot matching path.

Detection Methods for CVE-2026-64048

Indicators of Compromise

Kernel oops or panic messages referencing smc_conn_create and _raw_spin_lock_bh in call traces
KASAN null-ptr-deref reports with a write address of 0x68 originating from SMC code paths
Unexpected termination of processes calling connect() on AF_SMC sockets

Detection Strategies

Monitor kernel ring buffer (dmesg) and /var/log/kern.log for SMC-related crash signatures
Enable KASAN on test kernels to surface null pointer dereferences during SMC negotiation
Audit application inventories for processes using AF_SMC sockets or the SMC preloader

Monitoring Recommendations

Forward kernel crash telemetry to a centralized SIEM for correlation with network peer activity
Track SMC CLC handshake failures and abnormal disconnect patterns from untrusted peers
Alert on repeated kernel panics on hosts exposing SMC-D over reachable network segments

How to Mitigate CVE-2026-64048

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits as soon as vendor builds are available
Restrict SMC-D peer reachability to trusted hosts using network segmentation and firewall rules
Disable the SMC module on systems that do not require SMC-D functionality using modprobe blacklisting

Patch Information

The fix requires ism_dev[i] to be non-NULL before accepting a CHID match in smc_v2_determine_accepted_chid(). Patch commits are available in the stable kernel tree: Kernel Commit 2777400, Kernel Commit 53eb7b, Kernel Commit 65edb3, Kernel Commit 6927ca, Kernel Commit afa903, and Kernel Commit d38ba3.

Workarounds

Blacklist the smc and smc_diag kernel modules on hosts that do not require SMC-D connectivity
Block outbound SMC-D negotiation to untrusted networks using host and perimeter firewalls
Avoid running applications that use AF_SMC sockets against untrusted remote peers until patches are deployed

bash

# Configuration example: disable the SMC module until patched
echo 'blacklist smc' | sudo tee /etc/modprobe.d/disable-smc.conf
echo 'blacklist smc_diag' | sudo tee -a /etc/modprobe.d/disable-smc.conf
sudo depmod -a
sudo update-initramfs -u