CVE-2026-80979: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80979 Overview

CVE-2026-80979 is a use-after-free vulnerability in the Linux kernel's Shared Memory Communications (SMC) subsystem. The flaw resides in the net/smc connection teardown path, where smc_conn_free() fails to unregister a connection before draining the receive tasklet. A race condition between smc_lgr_terminate_sched() and the deferred connection kill work item leaves the smcd->conn[] slot populated. The device can re-arm the receive tasklet after tasklet_kill() returns, and on the DMB-nocopy path the freed ghost send buffer is then dereferenced.

Critical Impact
A local attacker with the ability to trigger SMC-D connection teardown races can cause kernel memory corruption, leading to denial of service or potential local privilege escalation.

Affected Products

Linux kernel versions containing the vulnerable net/smc code prior to the fixing commits
Systems using SMC-D (Shared Memory Communications over ISM devices)
Distributions shipping affected stable kernel branches

Discovery Timeline

2026-09-11 - CVE-2026-80979 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-80979

Vulnerability Analysis

The vulnerability is a use-after-free in the Linux kernel's net/smc subsystem, specifically affecting the SMC-D DMB-nocopy path. The kernel exposes a race window during link group termination that allows an interrupt-driven tasklet to access freed memory. This class of flaw falls under kernel memory corruption and can be leveraged from a local, low-privileged context to compromise kernel integrity.

SMC (Shared Memory Communications) is a network protocol that leverages Remote Direct Memory Access (RDMA) or Internal Shared Memory (ISM) devices for high-throughput socket communications. The affected code path handles connection lifecycle management when a link group is terminated. The fix, distributed across kernel commits 36cdf5d, 5bd8b76, b4d540a, b6b6ac7, and b74d313, ensures unconditional unregistration and tasklet draining before buffer detachment.

Root Cause

The root cause is an ordering defect in smc_conn_free(). The function calls smc_ism_unset_conn() only while the link group remains on its device list and never sets conn->killed. When smc_lgr_terminate_sched() unlinks the group immediately and defers connection destruction to a work item, a freed connection retains its smcd->conn[] slot with both gates in smcd_handle_irq() still open. The device can then re-arm the receive tasklet after tasklet_kill() has returned, dereferencing the freed ghost send buffer on the DMB-nocopy path.

Attack Vector

Exploitation requires local access with low privileges and no user interaction. An attacker must trigger SMC-D connection teardown under specific timing conditions to hit the narrow race window. Successful exploitation results in kernel memory corruption impacting confidentiality, integrity, and availability. See the Kernel Commit b74d313 for the authoritative fix diff.

Detection Methods for CVE-2026-80979

Indicators of Compromise

Kernel oops or panic messages referencing smcd_handle_irq, smc_conn_free, or tasklet_action in dmesg and /var/log/kern.log.
KASAN (Kernel Address Sanitizer) reports flagging use-after-free in the net/smc subsystem on kernels with sanitizers enabled.
Unexpected process crashes or system instability on hosts using SMC-D over ISM devices.

Detection Strategies

Inventory Linux hosts running affected kernel versions and identify those with the smc and smc_diag kernel modules loaded.
Monitor kernel logs for stack traces implicating tasklet handlers within the SMC subsystem after connection termination events.
Correlate kernel crash telemetry with workloads that establish and tear down SMC-D sockets at high frequency.

Monitoring Recommendations

Forward kernel logs and crash dumps to a centralized data lake for anomaly detection and retention.
Alert on repeated kernel faults originating from network subsystem code paths on the same host.
Track loaded kernel modules across the fleet to identify systems exposing the SMC attack surface.

How to Mitigate CVE-2026-80979

Immediate Actions Required

Apply the upstream kernel patches referenced in commits 36cdf5d, 5bd8b76, b4d540a, b6b6ac7, and b74d313 from your distribution vendor.
Identify hosts that load the smc module and prioritize them for patching, especially systems using IBM ISM devices.
Restrict local shell access on unpatched systems until updated kernels can be deployed and rebooted.

Patch Information

The fix unregisters the SMC connection unconditionally and drains the receive tasklet before detaching at both teardown sites, mirroring the handling of rmb_desc which smc_buf_unuse() releases after the drain. The patch also clears conn->sndbuf_desc before freeing it, preventing a reader that samples the pointer from obtaining an already freed buffer. Reference the Kernel Commit 36cdf5d and companion backports for stable branch alignment.

Workarounds

Blocklist the smc and smc_diag kernel modules on systems that do not require SMC connectivity.
Disable SMC-D functionality where it is not operationally needed to eliminate the vulnerable code path.
Enforce strict access controls limiting local logins to trusted administrators pending patch deployment.

bash

# Blocklist the SMC kernel modules until patched kernels are deployed
echo 'blacklist smc' | sudo tee /etc/modprobe.d/blacklist-smc.conf
echo 'blacklist smc_diag' | sudo tee -a /etc/modprobe.d/blacklist-smc.conf
sudo rmmod smc_diag smc 2>/dev/null
sudo update-initramfs -u