CVE-2026-98559

net/smc: fix UAF on lgr list traversal in smcr_port_err()

State: Published
Severity: Not scored
Published: Oct 18, 2026
Updated: Oct 19, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net/smc: fix UAF on lgr list traversal in smcr_port_err()

smcr_port_err() traverses smc_lgr_list.list without holding smc_lgr_list.lock, allowing a concurrent smc_lgr_terminate_sched() to free an lgr while it is still being dereferenced.

Hold smc_lgr_list.lock across the traversal. Update smc_ib_gid_check() to call smcr_port_err() after releasing the lock.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	541afa10c126b6c22c2a805a559c70cc41fd156e to before 34bcf11cd2528ae00bb6d764d808083c66824277Affected 541afa10c126b6c22c2a805a559c70cc41fd156e to before 0edcc4284392b28826b5d37532b366b291e6e0faAffected 541afa10c126b6c22c2a805a559c70cc41fd156e to before 00a59600ae72d24859d0ad1783a78bc921bc2599Affected 541afa10c126b6c22c2a805a559c70cc41fd156e to before 3d35f069e1c119992000d51236dbe54da2d4e61eAffected 541afa10c126b6c22c2a805a559c70cc41fd156e to before 3d65a2eb4449fc9658fb860dea893025d028d90eAffected 541afa10c126b6c22c2a805a559c70cc41fd156e to before a9b968e42690d784c241a0761c10253271f7df5dAffected 541afa10c126b6c22c2a805a559c70cc41fd156e to before 61cb282fe97b3b0ba32ca09417a693162bf4ae3fAffected
LinuxLinux	5.8Affected before 5.8Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.55 through 6.18.Not affected 7.2.9 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

541afa10c126b6c22c2a805a559c70cc41fd156e to before 34bcf11cd2528ae00bb6d764d808083c66824277Affected
541afa10c126b6c22c2a805a559c70cc41fd156e to before 0edcc4284392b28826b5d37532b366b291e6e0faAffected
541afa10c126b6c22c2a805a559c70cc41fd156e to before 00a59600ae72d24859d0ad1783a78bc921bc2599Affected
541afa10c126b6c22c2a805a559c70cc41fd156e to before 3d35f069e1c119992000d51236dbe54da2d4e61eAffected
541afa10c126b6c22c2a805a559c70cc41fd156e to before 3d65a2eb4449fc9658fb860dea893025d028d90eAffected
541afa10c126b6c22c2a805a559c70cc41fd156e to before a9b968e42690d784c241a0761c10253271f7df5dAffected
541afa10c126b6c22c2a805a559c70cc41fd156e to before 61cb282fe97b3b0ba32ca09417a693162bf4ae3fAffected

LinuxLinux

5.8Affected
before 5.8Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.55 through 6.18.*Not affected
7.2.9 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.