CVE-2026-74493

A flaw was found in the Linux kernel's net/smc component. A use-after-free vulnerability occurs during link group termination when a concurrent close operation unregisters a connection and frees its socket before the termination worker can properly hold the socket. This race condition can lead to a system crash, resulting in a denial of service.

A race in net/smc link group termination can lead to a socket use after free because __smc_lgr_terminate released conns_lock after finding a connection but before taking a socket reference with sock_hold(). A concurrent close can unregister the connection, drop the last reference, and free the embedded smc_sock before the termination worker uses it. For the CVSS the PR:L is used because a local user or process normally needs to create and close AF_SMC sockets to race link group termination, while no administrator privileges are required in the plausible triggering model. The attack complexity is high because reliable exploitation depends on a timing window between close and termination work. Impact is at least local denial of service via kernel crash, and in the paranoid score may include confidentiality and integrity impact because this is a real UAF with refcount misuse in kernel memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.