CVE-2026-80980: Linux Kernel Race Condition Vulnerability

CVE-2026-80980 Overview

CVE-2026-80980 is a race condition in the Linux kernel's SMC (Shared Memory Communications) networking subsystem. Three connection state flags (killed, freed, and out_of_sync) share a single byte in struct smc_connection as single-bit bitfields. Concurrent writes to any one flag perform a read-modify-write on the entire byte, corrupting the neighboring flags. The writes occur without a common lock: smc_cdc_msg_validate() sets out_of_sync from the receive tasklet, while smc_conn_kill() sets killed from process context under lock_sock(). The fix separates each flag into its own byte, growing struct smc_connection by two bytes.

Critical Impact
Concurrent bitfield writes across tasklet and process contexts can corrupt SMC connection state, leading to inconsistent lifecycle handling and potential denial-of-service or memory-safety consequences.

Affected Products

Linux kernel (SMC subsystem, net/smc)
Distributions shipping affected stable kernel versions prior to the fix commits
Systems using SMC-R or SMC-D for RDMA-accelerated TCP-compatible networking

Discovery Timeline

2026-09-11 - CVE-2026-80980 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-80980

Vulnerability Analysis

The vulnerability resides in struct smc_connection, where three lifecycle flags are declared as adjacent single-bit bitfields:

u8 killed : 1;
u8 freed : 1;
u8 out_of_sync : 1;

Because the C compiler packs these bitfields into a single byte, any write to one flag compiles into a read-modify-write of the entire byte. When two CPUs update different flags without synchronization, one update can silently overwrite the other. This is a classic bitfield concurrency hazard [CWE-362].

The SMC receive path amplifies the risk. smc_cdc_msg_recv() acquires only bh_lock_sock() and does not defer processing to the socket backlog when the socket is owned by a user thread. As a result, smc_cdc_msg_validate() can set out_of_sync from softirq/tasklet context while smc_conn_kill() concurrently sets killed from process context under lock_sock(). Neither path serializes with the other on the shared byte.

Root Cause

The root cause is the absence of atomic access or a common lock guarding co-located bitfields that are written from different execution contexts. The Linux memory model does not guarantee that bitfield stores are safe under concurrent write conditions, even when logically distinct fields are targeted.

Attack Vector

Exploitation requires the ability to trigger concurrent SMC connection teardown and inbound CDC (Connection Data Control) message processing. A remote peer generating malformed or racing CDC traffic against a socket being killed can induce the race. Successful races corrupt connection state flags, which may leave a socket in an inconsistent state where teardown accounting, freeing logic, or synchronization tracking behaves incorrectly.

See the upstream fix commits for the exact source-level changes: kernel.org commit 2cb7a8d6, kernel.org commit 313f7914, and kernel.org commit db51a865.

Detection Methods for CVE-2026-80980

Indicators of Compromise

Unexpected SMC socket teardown warnings or WARN_ON messages in dmesg referencing net/smc
Kernel logs showing SMC connections stuck in inconsistent lifecycle states (for example, freed sockets still tracked as live)
KCSAN (Kernel Concurrency Sanitizer) reports flagging data races on struct smc_connection bitfields

Detection Strategies

Inventory running kernel versions against the fixed stable branches referenced in the upstream commits
Enable KCSAN on test systems to surface concurrent access to SMC connection flags
Audit workloads that use SMC-R or SMC-D and correlate crash or hang telemetry with SMC socket teardown events

Monitoring Recommendations

Collect dmesg and kernel crash dumps centrally and alert on net/smc stack traces
Track kernel package versions across the fleet and flag hosts running vulnerable builds
Monitor SMC connection counters (/proc/net/smc*) for anomalous churn or stuck sessions

How to Mitigate CVE-2026-80980

Immediate Actions Required

Apply the upstream stable-kernel patches that separate killed, freed, and out_of_sync into distinct bytes
Update to the vendor kernel package incorporating the referenced commits as soon as it is released
If SMC is not required, disable the smc module to remove the attack surface entirely

Patch Information

The fix is delivered by three upstream commits that change the bitfield declarations in struct smc_connection so each flag occupies its own byte, eliminating the read-modify-write overlap. Refer to kernel.org commit 2cb7a8d6, kernel.org commit 313f7914, and kernel.org commit db51a865. Track your distribution's security advisories for backported builds.

Workarounds

Blacklist the smc kernel module on systems that do not use Shared Memory Communications
Restrict AF_SMC socket creation via seccomp or LSM policies for untrusted workloads
Limit exposure of SMC endpoints to trusted network segments until patches are deployed

bash

# Disable the SMC module on hosts that do not need it
echo 'install smc /bin/true' | sudo tee /etc/modprobe.d/disable-smc.conf
sudo rmmod smc_diag smc 2>/dev/null || true

# Verify the module is not loaded
lsmod | grep -E '^smc'