CVE-2026-64541: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64541 Overview

CVE-2026-64541 is a use-after-free vulnerability in the Linux kernel's Shared Memory Communications over RDMA (SMC-R) subsystem. The flaw resides in smc_cdc_rx_handler() within net/smc/smc_cdc.c, where the connection lookup releases the link group's conns_lock before dereferencing the associated smc_sock structure. A concurrent socket close path can free the socket between the lock release and the subsequent sock_hold() call, causing the handler to operate on freed memory. Only SMC-R deployments are affected because the SMC-D receive tasklet is stopped before the connection is unregistered.

Critical Impact
Remote attackers on the network can trigger memory corruption in the kernel through SMC-R traffic, potentially leading to kernel panic, denial of service, or privilege escalation.

Affected Products

Linux kernel (SMC-R subsystem, net/smc/smc_cdc.c)
Systems with Shared Memory Communications over RDMA enabled
Distributions shipping vulnerable stable kernel branches prior to the referenced fix commits

Discovery Timeline

2026-07-27 - CVE-2026-64541 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64541

Vulnerability Analysis

The vulnerability is a classic use-after-free race condition [CWE-416] in the SMC-R receive path. The function smc_cdc_rx_handler() looks up an SMC connection by token while holding the link group's conns_lock. After finding the connection, the handler drops the lock and then dereferences both conn and its derived smc_sock, ultimately calling sock_hold(&smc->sk) inside smc_cdc_msg_recv().

Between the lock release and the sock_hold() invocation, no reference pins the socket in place. The only reference protecting the socket is taken in smc_lgr_register_conn() and released in __smc_lgr_unregister_conn(), both under conns_lock. A concurrent close() traversing smc_release() → smc_conn_free() → smc_lgr_unregister_conn() can drop that reference and free the smc_sock before the handler reacquires it.

Root Cause

The root cause is inadequate lifetime management of the smc_sock object across a lock boundary. The handler assumes the connection remains valid after conns_lock is released, but the socket's pinning reference is itself released under that same lock during teardown. This creates a race window where the socket can be freed while a receive tasklet still holds a raw pointer to it. The upstream fix acquires the socket reference while conns_lock is still held, guaranteeing that the registration reference cannot be the last one.

Attack Vector

Exploitation requires the ability to send SMC-R traffic to a vulnerable host and to induce a concurrent connection teardown. An attacker who can trigger the receive tasklet (smc_wr_rx_tasklet_fn) while a socket close is in flight can race the free against the handler's sock_hold(). Observed impact includes a refcount_warn_saturate warning followed by a kernel panic when panic_on_warn is set. Successful exploitation of the freed memory could enable further memory corruption primitives.

No verified public exploit code is available. See the Linux kernel commit for the fix details.

Detection Methods for CVE-2026-64541

Indicators of Compromise

Kernel log entries containing refcount_warn_saturate originating from smc_cdc_msg_recv or smc_cdc_rx_handler
Unexpected kernel panics on hosts running SMC-R workloads under the rxe_wq workqueue
Anomalous SMC-R connection churn combined with tasklet-related warnings in dmesg

Detection Strategies

Monitor kernel ring buffer and syslog for warnings referencing net/smc/smc_cdc.c line 430 or 502
Correlate SMC-R traffic bursts with kernel crash events on RDMA-enabled hosts
Track kernel versions across the fleet and flag hosts running unpatched SMC-R stacks

Monitoring Recommendations

Enable persistent kernel crash dumps (kdump) on RDMA hosts to capture stack traces for post-mortem analysis
Alert on any refcount_t saturation warnings emitted from network subsystems
Audit which workloads require SMC-R and disable the module where it is not needed

How to Mitigate CVE-2026-64541

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the stable tree commits as soon as vendor kernels are available
Inventory hosts with the smc module loaded and prioritize patching those exposed to untrusted RDMA networks
Where patching is delayed, unload the smc module on systems that do not require SMC-R

Patch Information

The fix pins the socket reference while conns_lock is still held in smc_cdc_rx_handler() and releases it after the handler completes. Fixed stable kernel commits include 1951bffbc649, 3bfb96d9bc6a, 472e9d7c0d5b, 647b19e5cc14, 8145b4321362, 8de4f665d0fe, 9d160b35cc34, and ce5aa8084329. Consult your distribution's security tracker for backported package versions.

Workarounds

Blacklist the smc kernel module on systems that do not use SMC-R: add blacklist smc to /etc/modprobe.d/
Restrict RDMA network exposure using host firewalls and network segmentation to limit which peers can initiate SMC-R sessions
Disable panic_on_warn where operational continuity outweighs strict fail-closed behavior, understanding this only masks symptoms

bash

# Configuration example: disable SMC module loading
echo "blacklist smc" | sudo tee /etc/modprobe.d/disable-smc.conf
echo "install smc /bin/true" | sudo tee -a /etc/modprobe.d/disable-smc.conf
sudo rmmod smc 2>/dev/null || true
sudo update-initramfs -u