CVE-2026-80981

A flaw was found in the Linux kernel's net/smc component. A local attacker could exploit a use-after-free vulnerability in the smc_llc_srv_add_link() function, where a freed memory region is improperly accessed. This can lead to memory corruption and potentially result in a denial of service (DoS).

A use-after-free in the SMC LLC add link server path occurs because add_llc points into an LLC queue entry that can be freed before smc_llc_save_add_link_rkeys reads from it. A remote SMC peer on the same SMC/RDMA or rxe capable network may be able to trigger the vulnerable add link flow when SMC-R V2 is used and the connection does not use a shared v2 receive buffer. For the CVSS the PR:N is used because the attacker does not need a local account on the victim and only needs protocol reachability to the exposed SMC service in the relevant fabric. The attack complexity is high because exploitation depends on a specific SMC-R configuration and link negotiation state. Impact is at least denial of service via kernel crash and in the paranoid case may include confidentiality or integrity impact because the bug is a real UAF read from a freed kmalloc object.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.