CVE-2026-80983

A flaw was found in the Linux kernel's implementation of the Server Message Block (SMB) over Remote Direct Memory Access (RDMA) protocol, specifically within the net/smc component. An error path in the smc_switch_conns() function, triggered during link failover events, can lead to a socket reference count leak. This prevents the affected socket from being properly destroyed, causing its associated send and receive buffers to remain allocated. Consequently, the network namespace cannot be fully released, potentially resulting in a Denial of Service (DoS) due to resource exhaustion.

A low impact flaw was found in the Linux kernel's net/smc (SMC over RDMA) implementation. During RDMA link failover, smc_switch_conns() takes a reference on the SMC socket before fetching a CDC buffer slot, but the error exit taken when that fetch fails returns without releasing that reference. Such fetch failures occur when the target link goes down or the connection is killed while the switch is in progress, so the leak is triggered by the same hardware events that cause the failover itself. The leaked socket reference keeps the SMC socket from ever being destroyed, leaving its send and receive buffers allocated, and for user sockets the reference held on the network namespace is never released, so the network namespace can no longer be torn down. A local user able to establish SMC connections over RDMA could therefore gradually exhaust kernel resources and cause a denial of service. Red Hat rates this flaw low impact, with a Red Hat CVSS3 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Red Hat Enterprise Linux 6 and 7 Extended Lifecycle Support and Red Hat Enterprise Linux 8.4 are not affected because the vulnerable code is not present in those kernels. For the affected Red Hat Enterprise Linux 8 and 9 kernel and kernel-rt update streams, and the OpenShift Container Platform releases whose RHCOS images ship those kernels, the fix is deferred: the flaw is low impact with a CVSS score below the threshold at which Red Hat files errata, so no update is currently planned, and the residual risk is limited to slow, local resource exhaustion on systems that use SMC over RDMA.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.