CVE-2026-80982

A flaw was found in the Linux kernel's Shared Memory Communications (SMC) network protocol. A race condition occurs when a network connection is closed while the system is still processing its receive buffer pages. This can lead to a use-after-free vulnerability, where the system attempts to access memory that has already been released. An attacker could potentially exploit this flaw to cause a denial of service, leading to system instability or crashes.

An SMC splice receive path race can cause a use-after-free in smc_rx_pipe_buf_release() because the socket state was checked before taking the socket lock. A concurrent close can run smc_conn_free() and release conn rmb_desc and conn lgr while a pipe buffer release later calls smc_rx_update_cons() and dereferences those freed connection objects. For the CVSS the PR:L is selected because reliable triggering needs a local user context able to create and use an SMC socket and splice data into a pipe. The issue is not a direct unauthenticated network trigger, although a remote SMC peer may influence timing by sending data or closing the connection. Impact is at least local denial of service via kernel crash.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.