CVE-2026-80984

A flaw was found in the net/smc component of the Linux kernel. When a link group terminates while a socket is waiting in smc_close_stream_wait(), a NULL pointer dereference can occur during the SMC-D teardown path. This can lead to a system crash, resulting in a Denial of Service (DoS).

A moderate impact NULL pointer dereference flaw was found in the net/smc (Shared Memory Communications) subsystem of the Linux kernel, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 9 and 10 and the Red Hat Enterprise Linux CoreOS 9 kernel shipped with OpenShift Container Platform 4.22. When an SMC-D link group terminates while a socket is waiting in smc_close_stream_wait(), the smc_tx_prepared_sends() helper may dereference the already-cleared conn->sndbuf_desc pointer (the SIOCOUTQ ioctl path is affected in the same way), causing a kernel crash and resulting in a denial of service. A local user able to use SMC sockets could trigger this crash during socket teardown under specific timing conditions. Older Red Hat Enterprise Linux and OpenShift streams are not affected because the vulnerable code is not present in them. Because this flaw is rated moderate severity with a CVSS 3.1 score below 7.0, the fix has been deferred in accordance with Red Hat's policy for moderate-severity kernel flaws; the residual risk is limited to a local denial of service on systems that use SMC-D connections. This availability-only impact is reflected in Red Hat's CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.