CVE-2026-74719 Overview
CVE-2026-74719 is a memory leak vulnerability in the Linux kernel's Shared Memory Communications (SMC) subsystem. The flaw resides in the smc_llc_event_handler() function within net/smc, specifically in the Link Layer Control (LLC) event handling logic. The SMC_LLC_CONFIRM_LINK and SMC_LLC_ADD_LINK_CONT branches store an incoming qentry into the local LLC flow without first verifying whether a qentry is already pending. A malicious or buggy peer sending duplicate messages while a flow is active can trigger repeated leaks of kmalloc-96 objects, causing gradual kernel memory exhaustion.
Critical Impact
Remote peers can leak kernel memory (one kmalloc-96 object per spurious LLC message), enabling a slow resource exhaustion condition against SMC-enabled Linux systems.
Affected Products
- Linux kernel (net/smc subsystem)
- Systems using Shared Memory Communications (SMC) protocol
- Distributions shipping vulnerable kernel versions prior to the referenced stable fixes
Discovery Timeline
- 2026-08-22 - CVE-2026-74719 published to the National Vulnerability Database (NVD)
- 2026-08-22 - Last updated in NVD database
Technical Details for CVE-2026-74719
Vulnerability Analysis
The vulnerability affects the Linux kernel SMC protocol implementation, which enables high-performance communication between hosts using RDMA. LLC messages coordinate link management between SMC peers. In smc_llc_event_handler(), the SMC_LLC_CONFIRM_LINK and SMC_LLC_ADD_LINK_CONT branches call smc_llc_flow_qentry_set() to store an incoming queue entry into the active flow. The code path fails to check whether flow->qentry is already populated before overwriting it.
When a peer sends a second CONFIRM_LINK or ADD_LINK_CONT request while a flow is already active, the existing qentry pointer is overwritten. The previously allocated object is no longer referenced and cannot be freed. Each spurious message leaks one kmalloc-96 slab allocation, and repeated exploitation drives sustained kernel memory pressure.
Root Cause
The root cause is a missing !flow->qentry guard in two branches of the LLC event dispatcher. The sibling SMC_LLC_DELETE_LINK branch already implements this guard correctly, and the response path in smc_llc_rx_response() similarly protects itself by checking flow->qentry before assignment. The CONFIRM_LINK and ADD_LINK_CONT branches diverged from this pattern, producing an unbounded overwrite of a heap pointer without releasing the prior allocation. This qualifies as a Memory Leak defect in kernel networking code.
Attack Vector
The attack requires a remote SMC peer capable of sending LLC control messages to a target host with an active SMC link flow. By transmitting duplicate CONFIRM_LINK or ADD_LINK_CONT frames after a flow has been established and a qentry is already queued, the attacker causes the kernel to leak a small heap object per message. Sustained abuse leads to progressive kernel memory consumption. The fix applies the same guard used elsewhere in the function so duplicate messages fall through to the out: label where kfree(qentry) releases the allocation.
See the upstream fix in the Kernel Update Commit 06734df and the parallel stable backports for detailed patch content.
Detection Methods for CVE-2026-74719
Indicators of Compromise
- Gradual, unexplained growth in the kmalloc-96 slab cache visible in /proc/slabinfo on SMC-enabled hosts
- Elevated volume of SMC_LLC_CONFIRM_LINK or SMC_LLC_ADD_LINK_CONT events in kernel tracepoints from a single or small set of peers
- Kernel memory pressure or OOM events on hosts running SMC workloads without a corresponding userland cause
Detection Strategies
- Monitor slab allocator statistics for anomalous growth of general-purpose caches (kmalloc-96) on hosts running SMC
- Use eBPF or ftrace tracepoints on smc_llc_event_handler to observe repeated LLC control messages from the same peer
- Correlate kernel version and SMC configuration with vendor advisories to identify unpatched systems
Monitoring Recommendations
- Baseline normal SMC LLC traffic patterns per peer and alert on sudden spikes in CONFIRM_LINK or ADD_LINK_CONT messages
- Track kernel slab and total kernel memory metrics with time-series alerting to catch slow leaks
- Enable audit logging for SMC link establishment and teardown events where supported
How to Mitigate CVE-2026-74719
Immediate Actions Required
- Apply the upstream Linux kernel patch or the corresponding stable backport shipped by your distribution
- Inventory hosts using the SMC protocol and prioritize kernel updates on those systems
- Restrict SMC connectivity to trusted peers using network segmentation and firewalling on relevant RDMA fabrics
Patch Information
The fix adds a !flow->qentry guard to the SMC_LLC_CONFIRM_LINK and SMC_LLC_ADD_LINK_CONT branches of smc_llc_event_handler(), mirroring the existing guard on the SMC_LLC_DELETE_LINK branch. Relevant stable tree commits include 06734df, 10cb31b, 9762450, a1e980d, bfc336a, c23c409, e0eb876, and e384f3c.
Workarounds
- Disable the SMC protocol on hosts that do not require it by blacklisting the smc kernel module
- Constrain SMC peers to a trusted set via network access controls where the protocol must remain enabled
- Schedule periodic reboots on long-running unpatched systems to reclaim leaked kernel memory until patching is complete
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
