CVE-2026-80982: Linux Kernel Use-After-Free Vulnerability

CVE-2026-80982 Overview

CVE-2026-80982 is a use-after-free vulnerability in the Linux kernel's Shared Memory Communications (SMC) subsystem. The flaw resides in smc_rx_pipe_buf_release() within net/smc, where a race condition allows a concurrent socket close to free connection state that the pipe release path then dereferences. A local attacker with the ability to open SMC sockets and trigger splice operations can exploit the race to corrupt kernel memory. The kernel maintainers have merged patches across multiple stable branches to serialize the release path and consult a new conn->freed flag under the socket lock.

Critical Impact
Successful exploitation can lead to kernel memory corruption, local privilege escalation, or a system crash on hosts using SMC sockets.

Affected Products

Linux kernel builds enabling the SMC protocol (CONFIG_SMC)
Distributions shipping affected upstream kernels prior to the referenced stable backports
Systems using SMC-R or SMC-D for RDMA-accelerated TCP workloads

Discovery Timeline

2026-09-11 - CVE-2026-80982 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-80982

Vulnerability Analysis

The SMC receive path uses smc_rx_splice() to hand Remote Memory Buffer (RMB) pages to a pipe. Each spliced entry takes a reference on the smc_sock so the socket remains valid while the reader consumes data. The underlying smc_connection, however, does not carry a matching reference. A concurrent socket close invokes smc_conn_free(), which returns the receive buffer to the link group pool and can free the descriptor entirely on the is_reg_err path via smcr_buf_unuse().

smc_rx_pipe_buf_release() previously checked sk_state before acquiring the socket lock. Because the state can transition between the check and the lock acquisition, the subsequent call to smc_rx_update_cons() dereferences conn->rmb_desc and walks conn->lgr after those structures have been released. The result is a classic use-after-free [CWE-416] reachable from local user context.

Root Cause

The root cause is unsynchronized state validation. The pipe release routine inspected connection state outside of the socket lock, creating a time-of-check-to-time-of-use window that smc_conn_free() could exploit to release the RMB descriptor and link group references before the release path finished its update.

Attack Vector

A local, authenticated user can trigger the race by concurrently splicing data from an SMC socket while closing the connection. Timing the close against pipe release causes the release path to operate on freed memory. Exploitation requires local access and low privileges, does not require user interaction, and produces high impact to confidentiality, integrity, and availability.

The upstream fix acquires the socket lock first and tests a new conn->freed flag that smc_conn_free() sets before releasing any structures. Every caller of smc_conn_free() already holds the socket lock, so the two paths now serialize cleanly.

Detection Methods for CVE-2026-80982

Indicators of Compromise

Kernel oops or panic messages referencing smc_rx_pipe_buf_release, smc_rx_update_cons, or smcr_buf_unuse in dmesg or /var/log/kern.log
KASAN reports flagging use-after-free reads on smc_connection or rmb_desc structures
Unexpected crashes on hosts running RDMA workloads that use SMC-R or SMC-D

Detection Strategies

Enable KASAN and Lockdep on test kernels to surface the race during pre-production validation of SMC workloads
Correlate perf or ftrace events on smc_conn_free and smc_rx_splice to identify overlapping executions on the same connection
Alert on repeated crashes of processes that open AF_SMC sockets, particularly those invoking splice(2) on received data

Monitoring Recommendations

Ingest kernel crash telemetry into a centralized data lake to detect clustered SMC-related faults across the fleet
Track loaded kernel versions and flag hosts still running unpatched builds where CONFIG_SMC=y
Monitor privileged local activity that opens AF_SMC sockets, since SMC is uncommon outside specific RDMA workloads

How to Mitigate CVE-2026-80982

Immediate Actions Required

Apply the upstream stable kernel updates that introduce the conn->freed flag and reorder the socket lock acquisition in smc_rx_pipe_buf_release()
Inventory hosts with CONFIG_SMC enabled and prioritize patching those exposed to untrusted local users or multi-tenant workloads
Restrict who can create AF_SMC sockets until patched kernels are deployed

Patch Information

Upstream maintainers have merged the fix across multiple stable trees. Refer to the commits: Kernel Patch Commit 0761e49, Kernel Patch Commit 0926f59, Kernel Patch Commit 6a644a7, Kernel Patch Commit c924884, Kernel Patch Commit dadd97a, and Kernel Patch Commit df441f3.

Workarounds

Disable the SMC protocol on systems that do not require it by blacklisting the smc module in /etc/modprobe.d/
Rebuild kernels without CONFIG_SMC where operationally feasible
Use sysctl and namespace controls to prevent unprivileged workloads from opening AF_SMC sockets

bash

# Blacklist the SMC module to prevent AF_SMC socket creation
echo 'blacklist smc' | sudo tee /etc/modprobe.d/blacklist-smc.conf
echo 'install smc /bin/true' | sudo tee -a /etc/modprobe.d/blacklist-smc.conf
sudo update-initramfs -u

# Verify the module is not loaded after reboot
lsmod | grep -i smc