CVE-2026-80979

A flaw was found in the Linux kernel's Shared Memory Communications (SMC) component. During connection termination, the SMC component may fail to properly unregister a connection before draining its receive tasklet. This can lead to a use-after-free vulnerability, where a freed memory buffer is subsequently dereferenced. A local attacker could potentially exploit this to cause a system crash, resulting in a denial of service, or potentially achieve arbitrary code execution.

A race in the SMC-D teardown path can leave a freed connection registered in the smcd conn table while device IRQ handling can still re-arm the rx tasklet after tasklet_kill has returned. In the DMB nocopy path the send buffer can be freed after the drain, so the re-armed tasklet may later dereference freed memory and crash the kernel. For the CVSS the PR:N is used because an adjacent SMC-D peer may only need reachability to a service using SMC-D and not a local account on the victim. The attack is not expected to be directly Internet reachable and is mainly relevant to systems using SMC-D over ISM or similar adjacent fabric deployments. Impact is at least denial of service via kernel crash and in the paranoid interpretation may include confidentiality or integrity impact because the bug class is use-after-free in kernel memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.