CVE-2026-64048

net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot

State: Published
Severity: 7.5 High
Published: Jul 19, 2026
Updated: Oct 19, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot

On the SMC-D client, slot 0 of ini->ism_dev[]/ini->ism_chid[] is reserved for an SMC-Dv1 device. smc_find_ism_v2_device_clnt() populates V2 entries starting at index 1, so when no V1 device is selected slot 0 is left in its kzalloc()'ed state with ism_dev[0] == NULL and ism_chid[0] == 0.

smc_v2_determine_accepted_chid() then matches the peer's CHID against the array starting from index 0 using the CHID alone. A malicious peer replying to a SMC-Dv2-only proposal with d1.chid == 0 matches the empty slot, ini->ism_selected becomes 0, and the subsequent ism_dev[0]->lgr_lock dereference in smc_conn_create() faults at offsetof(struct smcd_dev, lgr_lock) == 0x68:

BUG: KASAN: null-ptr-deref in _raw_spin_lock_bh+0x79/0xe0 Write of size 4 at addr 0000000000000068 by task exploit/144 Call Trace: _raw_spin_lock_bh smc_conn_create (net/smc/smc_core.c:1997) __smc_connect (net/smc/af_smc.c:1447) smc_connect (net/smc/af_smc.c:1720) __sys_connect __x64_sys_connect do_syscall_64

Require ism_dev[i] to be non-NULL before accepting a CHID match.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

CWE-476 NULL Pointer Dereference

Affected Products

Product	Versions
LinuxLinux	a7c9c5f4af7f6098da68705fc5d86565d0728ef7 to before 903f7688ffeb9b323d70652c01f554bd4ba2a3d6Affected a7c9c5f4af7f6098da68705fc5d86565d0728ef7 to before dd2f9dd83c68abd7ba7ded7075290b016cb7ecd0Affected a7c9c5f4af7f6098da68705fc5d86565d0728ef7 to before 6927cacf2b10d4fa80c1a2d407512ef9397c59c6Affected a7c9c5f4af7f6098da68705fc5d86565d0728ef7 to before d38ba387244e5c5f7db3e11ea98bc2c7beccb0c0Affected a7c9c5f4af7f6098da68705fc5d86565d0728ef7 to before 53eb7bd09aace72fa17510d80e0caf5ca058c231Affected a7c9c5f4af7f6098da68705fc5d86565d0728ef7 to before afa9036b8c9963947b487c36e332df6a42c96fcbAffected a7c9c5f4af7f6098da68705fc5d86565d0728ef7 to before 65edb3b0822cfe5041be8fbabebd57e2e5ad9f4eAffected a7c9c5f4af7f6098da68705fc5d86565d0728ef7 to before 277740023def559a4a2ddc3e8e784ee37a0f16a9Affected
LinuxLinux	5.10Affected before 5.10Not affected 5.10.266 through 5.10.Not affected 5.15.217 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.142 through 6.6.Not affected 6.12.92 through 6.12.Not affected 6.18.34 through 6.18.Not affected 7.0.11 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

a7c9c5f4af7f6098da68705fc5d86565d0728ef7 to before 903f7688ffeb9b323d70652c01f554bd4ba2a3d6Affected
a7c9c5f4af7f6098da68705fc5d86565d0728ef7 to before dd2f9dd83c68abd7ba7ded7075290b016cb7ecd0Affected
a7c9c5f4af7f6098da68705fc5d86565d0728ef7 to before 6927cacf2b10d4fa80c1a2d407512ef9397c59c6Affected
a7c9c5f4af7f6098da68705fc5d86565d0728ef7 to before d38ba387244e5c5f7db3e11ea98bc2c7beccb0c0Affected
a7c9c5f4af7f6098da68705fc5d86565d0728ef7 to before 53eb7bd09aace72fa17510d80e0caf5ca058c231Affected
a7c9c5f4af7f6098da68705fc5d86565d0728ef7 to before afa9036b8c9963947b487c36e332df6a42c96fcbAffected
a7c9c5f4af7f6098da68705fc5d86565d0728ef7 to before 65edb3b0822cfe5041be8fbabebd57e2e5ad9f4eAffected
a7c9c5f4af7f6098da68705fc5d86565d0728ef7 to before 277740023def559a4a2ddc3e8e784ee37a0f16a9Affected

LinuxLinux

5.10Affected
before 5.10Not affected
5.10.266 through 5.10.*Not affected
5.15.217 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.142 through 6.6.*Not affected
6.12.92 through 6.12.*Not affected
6.18.34 through 6.18.*Not affected
7.0.11 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.