CVE-2026-64048

A flaw was found in the Linux kernel's Server-Message-Block Direct (SMC-D) client. A remote attacker can exploit this vulnerability by sending a specially crafted SMC-Dv2 proposal with a Channel Identifier (CHID) of 0. This malicious proposal can cause a null pointer dereference in the kernel's SMC connection creation process, leading to a system crash and a Denial of Service (DoS).

A NULL pointer dereference in the SMC-D client CHID selection path can occur because CHID 0 from a peer can match the empty reserved slot 0 when no SMC-Dv1 device is selected. A malicious SMC peer can reply to an SMC-Dv2 only proposal with CHID 0, causing the client to select a NULL ISM device and later dereference lgr_lock during connection setup. For the CVSS the PR:N is used because the attacker only needs to control the peer endpoint or traffic seen by the SMC client, not a local account on the victim. The issue is network reachable in deployments where SMC-D or SMC-Dv2 negotiation is enabled and a client connects to an attacker controlled peer. Impact is denial of service only because the primitive shown by the code is a NULL pointer dereference, not UAF or controllable memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.