CVE-2026-80983 Overview
CVE-2026-80983 is a socket reference count leak in the Linux kernel's Shared Memory Communications (SMC) subsystem. The flaw resides in smc_switch_conns(), which handles connection failover between SMC links. When smc_cdc_get_free_slot() fails on the early error path, the function jumps to the err_out label without releasing the socket reference taken by the preceding sock_hold(). The leaked sk_refcnt prevents the smc_sock from being destroyed, keeps send and receive buffers allocated, and pins the network namespace so it cannot be torn down.
Critical Impact
Repeated link failover events exhaust kernel memory and prevent network namespace teardown, leading to progressive resource exhaustion on affected Linux systems using SMC.
Affected Products
- Linux kernel versions containing the smc_switch_conns() implementation in net/smc
- Systems using Shared Memory Communications over RDMA (SMC-R) or ISM (SMC-D)
- Container hosts leveraging network namespaces alongside SMC sockets
Discovery Timeline
- 2026-09-11 - CVE-2026-80983 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-80983
Vulnerability Analysis
The vulnerability is a memory leak rooted in unbalanced socket reference counting during SMC link failover. smc_switch_conns() is invoked when an SMC link goes down and traffic must be migrated to a peer link. To keep the connection alive while sleeping outside conns_lock, the function calls sock_hold(&smc->sk) before releasing the read lock and pre-fetching a Connection Data Control (CDC) buffer slot via smc_cdc_get_free_slot().
When smc_cdc_get_free_slot() returns an error, execution branches to the err_out label. That label only releases the wr_tx link reference and returns without a matching sock_put(). The second error exit later in the function is unaffected because sock_put() has already executed by that point.
Root Cause
The root cause is an asymmetric cleanup path [CWE-401: Missing Release of Memory after Effective Lifetime]. The sock_hold() call is paired with a sock_put() only along the success path and one of the two failure paths. The early err_out branch lacks the compensating reference release, leaving the socket permanently pinned.
Attack Vector
Exploitation does not require an authenticated attacker crafting a payload. smc_cdc_get_free_slot() fails when the target link goes down or when the connection is killed during a switch. Both conditions are reachable during the same hardware failover events that cause smc_switch_conns() to run. Repeated link-instability events on RDMA hardware or ISM devices trigger the leak, causing gradual kernel memory exhaustion and preventing associated network namespaces from being freed.
No verified proof-of-concept code is available. Detailed technical context is provided in the upstream fix commits, including Linux Kernel Commit d9a879a and Linux Kernel Commit e202270.
Detection Methods for CVE-2026-80983
Indicators of Compromise
- Network namespaces that remain allocated after all visible processes and sockets have exited, observable via /proc/net/ and ip netns inconsistencies.
- Growth in slab accounting for sock_inode_cache and SMC-related buffers on hosts with recurring RDMA or ISM link events.
- Kernel log entries from net/smc indicating repeated link failover or CDC slot acquisition failures.
Detection Strategies
- Monitor smc_sock and namespace object counts over time on systems that use SMC-R or SMC-D and correlate against link-down events.
- Track kernel memory growth patterns that coincide with RDMA fabric instability rather than user workload changes.
- Audit installed kernel versions against distribution advisories referencing the seven upstream fix commits.
Monitoring Recommendations
- Alert on unbounded growth of unreachable network namespaces on container hosts using SMC.
- Collect dmesg output related to smc_switch_conns and smc_cdc_get_free_slot failures for offline analysis.
- Instrument RDMA and ISM device error counters to identify environments where the buggy code path is exercised.
How to Mitigate CVE-2026-80983
Immediate Actions Required
- Apply the upstream Linux kernel patches that restructure smc_switch_conns() to place a single sock_put() covering both error outcomes.
- Prioritize patching hosts that use SMC-R or SMC-D over RDMA and ISM devices, particularly those experiencing frequent link failovers.
- Inventory container and virtualization hosts for SMC usage and schedule reboots after installing patched kernels.
Patch Information
The fix has been merged across multiple stable trees. Reference commits: 09d7a9e, 719296c, 84dea05, a337846, d89dc1b, d9a879a, and e202270. Consume the fixes through your distribution's kernel update channel.
Workarounds
- Disable the SMC protocol on hosts that do not require it by blacklisting the smc and smc_diag kernel modules.
- Where SMC is optional, revert workloads to standard TCP sockets until patched kernels are deployed.
- Reduce exposure by stabilizing the underlying RDMA or ISM fabric to minimize link failover events that trigger the leaked code path.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
