CVE-2026-80981: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80981 Overview

CVE-2026-80981 is a use-after-free vulnerability in the Linux kernel's Shared Memory Communications (SMC) subsystem. The flaw resides in smc_llc_srv_add_link() within net/smc/smc_llc.c, where a pointer into a queue entry is dereferenced after the entry has been freed. On links without a shared v2 receive buffer, the code path passes an already-freed pointer to smc_llc_save_add_link_rkeys(), producing a slab use-after-free reachable through the smc_hs_wq workqueue during connection listen processing.

Critical Impact
Remote attackers reaching an SMC listener over the network can trigger kernel memory corruption, potentially leading to denial of service or arbitrary kernel code execution.

Affected Products

Linux kernel versions containing the regression introduced by the referenced Fixes: commit prior to the patch
Systems using net/smc (SMC-R) over RDMA transports, including softRoCE (rxe)
Distributions shipping affected upstream stable kernels prior to the fix commits

Discovery Timeline

2026-09-11 - CVE-2026-80981 published to NVD
2026-09-13 - Last updated in NVD database

Technical Details for CVE-2026-80981

Vulnerability Analysis

The vulnerability is a classic use-after-free [CWE-416] in the SMC Link Layer Control (LLC) handling path. In smc_llc_srv_add_link(), the local add_llc pointer is initialized to &qentry->msg.add_link, aliasing memory owned by the queue entry qentry. The function later calls smc_llc_flow_qentry_del(&lgr->llc_flow_lcl), which invokes kfree() on that queue entry.

After the free, execution reaches a conditional that selects between lgr->wr_rx_buf_v2 and the stale add_llc pointer depending on whether a shared v2 receive buffer is present. When smc_link_shared_v2_rxbuf(link) returns false, llc_msg is set to the freed add_llc and passed to smc_llc_save_add_link_rkeys(), which reads from freed slab memory. The reporter reproduced the issue over rxe with KASAN enabled and a link forced to max_recv_sge == 1.

Root Cause

A prior refactor changed the branch that previously always used lgr->wr_rx_buf_v2 to conditionally reuse add_llc. The lifetime of qentry was not extended to cover this new use, so freeing the queue entry before the final dereference invalidates the aliased pointer. The bug is exposed only on links that lack the shared v2 receive buffer path.

Attack Vector

The vulnerable code runs inside smc_listen_work on the smc_hs_wq workqueue, meaning the code path is reachable during handshake processing of incoming SMC-R connections. An attacker able to negotiate an SMC-R connection to a listening host under conditions that avoid the v2 shared receive buffer can trigger the use-after-free, corrupting kernel slab memory allocated by smc_llc_enqueue().

No verified proof-of-concept code is published. See the upstream fix commits for the precise instruction sequence: kernel commit a42a459e, kernel commit adef84cc, and kernel commit c52a998a.

Detection Methods for CVE-2026-80981

Indicators of Compromise

KASAN reports referencing slab-use-after-free in smc_llc_save_add_link_rkeys with a freeing stack including smc_llc_flow_qentry_del and an allocating stack from smc_llc_enqueue.
Unexpected kernel oops or panics in the smc_hs_wq workqueue running smc_listen_work.
Anomalous crashes on hosts exposing SMC-R listeners over RDMA or rxe interfaces.

Detection Strategies

Enable KASAN and kasan_multi_shot on test kernels running SMC-R workloads to surface the use-after-free during handshake fuzzing.
Monitor kernel logs for BUG: KASAN entries and for stack traces that include smc_llc_srv_add_link or smc_llc_save_add_link_rkeys.
Inventory kernels against the fix commits above to identify hosts still exposed.

Monitoring Recommendations

Forward kernel dmesg and journald events to a centralized logging platform and alert on KASAN, Oops, or general protection fault strings referencing SMC symbols.
Track use of the smc module (lsmod | grep smc) and RDMA transports (ib_core, rdma_rxe) across the fleet.
Alert on repeated crashes of the smc_hs_wq workqueue, which can indicate active exploitation attempts.

How to Mitigate CVE-2026-80981

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by the fix commits and update to a kernel release that includes them.
Restrict network exposure of SMC-R listeners to trusted hosts using firewall or namespace segmentation until patched kernels are deployed.
Audit hosts for loaded smc and rdma_rxe modules and disable them where SMC is not required.

Patch Information

The fix is upstream in the stable Linux kernel tree. See kernel commit a42a459e, kernel commit adef84cc, and kernel commit c52a998a. The patch reorders the code so that data from qentry is consumed before smc_llc_flow_qentry_del() frees the entry, eliminating the stale pointer usage.

Workarounds

Unload the smc module on hosts that do not require SMC-R: modprobe -r smc.
Blacklist smc and rdma_rxe via /etc/modprobe.d/ on systems that must not expose these transports.
Constrain SMC-R traffic to isolated management networks and block ingress on external interfaces at the host firewall.

bash

# Configuration example: disable SMC and softRoCE modules until patched
echo 'blacklist smc'      | sudo tee /etc/modprobe.d/disable-smc.conf
echo 'blacklist rdma_rxe' | sudo tee -a /etc/modprobe.d/disable-smc.conf
sudo modprobe -r smc      2>/dev/null || true
sudo modprobe -r rdma_rxe 2>/dev/null || true
sudo update-initramfs -u