All vulnerabilities
CVE-2026-98559

Linux: net/smc: fix UAF on lgr list traversal in smcr_port_err()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.21%Chance of exploitation activity in the next 30 days, higher than 10% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in34bcf11cd2528ae00bb6d764d808083c66824277Also 0edcc4284392b28826b5d37532b366b291e6e0fa, 00a59600ae72d24859d0ad1783a78bc921bc2599 and 3 moreCVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 34bcf11cd2528ae00bb6d764d808083c66824277LinuxCVE List
  • 0edcc4284392b28826b5d37532b366b291e6e0faLinuxCVE List
  • 00a59600ae72d24859d0ad1783a78bc921bc2599LinuxCVE List
  • 3d35f069e1c119992000d51236dbe54da2d4e61eLinuxCVE List
  • 3d65a2eb4449fc9658fb860dea893025d028d90eLinuxCVE List
  • 61cb282fe97b3b0ba32ca09417a693162bf4ae3fLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

net/smc: fix UAF on lgr list traversal in smcr_port_err()

smcr_port_err() traverses smc_lgr_list.list without holding smc_lgr_list.lock, allowing a concurrent smc_lgr_terminate_sched() to free an lgr while it is still being dereferenced.

Hold smc_lgr_list.lock across the traversal. Update smc_ib_gid_check() to call smcr_port_err() after releasing the lock.

Text from CVE List

Affected versions 16

  • Linuxaffected: 541afa10c126b6c22c2a805a559c70cc41fd156e before 34bcf11cd2528ae00bb6d764d808083c66824277CVE List
  • Linuxaffected: 541afa10c126b6c22c2a805a559c70cc41fd156e before 0edcc4284392b28826b5d37532b366b291e6e0faCVE List
  • Linuxaffected: 541afa10c126b6c22c2a805a559c70cc41fd156e before 00a59600ae72d24859d0ad1783a78bc921bc2599CVE List
  • Linuxaffected: 541afa10c126b6c22c2a805a559c70cc41fd156e before 3d35f069e1c119992000d51236dbe54da2d4e61eCVE List
  • Linuxaffected: 541afa10c126b6c22c2a805a559c70cc41fd156e before 3d65a2eb4449fc9658fb860dea893025d028d90eCVE List
  • Linuxaffected: 541afa10c126b6c22c2a805a559c70cc41fd156e before a9b968e42690d784c241a0761c10253271f7df5dCVE List
  • Linuxaffected: 541afa10c126b6c22c2a805a559c70cc41fd156e before 61cb282fe97b3b0ba32ca09417a693162bf4ae3fCVE List
  • Linuxaffected: 5.8CVE List
  • Linuxunaffected: all versions before 5.8CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.55 through 6.18.*CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 7