Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-74719

net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() The SMC_LLC_CONFIRM_LINK / SMC_LLC_ADD_LINK_CONT branch in smc_llc_event_handler() stores an incoming qentry into the local LLC flow without first checking whether a qentry is already pending. If a malicious or buggy peer sends a second CONFIRM_LINK or ADD_LINK_CONT request while a flow is active and flow->qentry is already set, smc_llc_flow_qentry_set() overwrites the pointer without freeing the previous allocation, leaking one kmalloc-96 object per spurious message. The sibling SMC_LLC_DELETE_LINK branch already has the correct !flow->qentry guard. Apply the same guard to the CONFIRM_LINK/ADD_LINK_CONT branch so that a duplicate message when qentry is already occupied falls through to break and is freed by the kfree(qentry) at the out: label, rather than silently leaking the existing allocation. The response direction (smc_llc_rx_response()) is unaffected: it already guards with flow->qentry at the equivalent site and drops duplicate responses correctly.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 to < e384f3cba6ea709f5b2272b1770db4ce14047f78affected
  • 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 to < a1e980d7a9e7ee6faf4f5fd7b450413b969af26daffected
  • 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 to < e0eb87677c76b157cdf8eb7c1f19e56227165a33affected
  • 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 to < 06734dfeaeba886aab1bf147249195b888ac3e4daffected
  • 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 to < c23c409228629107203d3c3e95fff1473173f1a6affected
  • 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 to < 10cb31b2b74cb664c6c95cf72364d7d5c483ab82affected
  • 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 to < bfc336a9fbbf09805f3dfe25c195a4db90af2846affected
  • 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 to < 976245094925bab9bc39366b2e9ab44ffcde61d0affected

Linux Linux

Default version status: affected

  • 5.8affected
  • 0 to < 5.8unaffected
  • 5.10.265 to ≤ 5.10.*unaffected
  • 5.15.216 to ≤ 5.15.*unaffected
  • 6.1.183 to ≤ 6.1.*unaffected
  • 6.6.152 to ≤ 6.6.*unaffected
  • 6.12.104 to ≤ 6.12.*unaffected
  • 6.18.45 to ≤ 6.18.*unaffected
  • 7.1.9 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References