CVE-2026-80980

A flaw was found in the Linux kernel's SMC (Server Message Block over Remote Direct Memory Access) protocol implementation. A concurrency issue exists where three connection state flags (killed, freed, and out_of_sync) share a single byte in the smc_connection structure without proper locking mechanisms. This allows for a read-modify-write race condition when different functions attempt to modify these flags simultaneously. This could lead to incorrect connection state management, potentially causing unexpected behavior or a denial of service.

A MODERATE severity concurrency flaw was found in the Linux kernel's SMC protocol implementation. The three connection state flags killed, freed, and out_of_sync are single-bit bitfields that share one byte of struct smc_connection, and they are not written under a common lock: out_of_sync is set from the receive tasklet in smc_cdc_msg_validate(), while killed is set from process context under lock_sock() in smc_conn_kill(). Concurrent stores to these flags therefore perform unsynchronized read-modify-write operations on the shared byte, which can result in incorrect connection state management, unexpected behavior, or a denial of service. Red Hat scored this flaw CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which differs substantially from the upstream CVEORG score of 9.8 because, per the Red Hat assessment, triggering the flaw requires local access to establish SMC connections and impacts only availability, with no direct impact on confidentiality or integrity. The vulnerable code is present in the kernel packages of Red Hat Enterprise Linux 8, 9, and 10 and in the RHCOS kernels shipped with OpenShift Container Platform 4, which are marked affected; the Red Hat Enterprise Linux 6 and 7 ELS kernels do not contain this code and are not affected. Because the impact is MODERATE with a CVSS score below the 7.0 threshold, the fix is deferred and no bug trackers are being filed for this issue at this time; the residual risk is limited to potential connection state corruption or denial of service on systems actively using SMC connections.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.