{"id":"CVE-2026-80980","state":"PUBLISHED","title":"net/smc: stop killed, freed and out_of_sync sharing a byte","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: stop killed, freed and out_of_sync sharing a byte\n\nThe three connection state flags are single-bit bitfields, so they occupy\none byte of struct smc_connection and every store to one is a\nread-modify-write of the other two:\n\n    u8  killed : 1;\n    u8  freed : 1;\n    u8  out_of_sync : 1;\n\nThey are not written under a common lock. smc_cdc_msg_validate() sets\nout_of_sync from the receive tasklet, while smc_conn_kill() sets killed\nfrom process context under lock_sock(), and the receive path does not defer\nto the backlog when the socket is owned -- smc_cdc_msg_recv() takes only\nbh_lock_sock().\n\nGive each flag its own byte so a store no longer touches its neighbours.\nAll readers test them as booleans and are unchanged. struct smc_connection\ngrows by two bytes.","publishedAt":"2026-09-11T19:42:40.832Z","updatedAt":"2026-10-30T12:31:33.078Z","severity":{"score":9.8,"label":"Critical","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"b286a0651e4404ab96cdfdcdad8a839a26b3751e","status":"affected","lessThan":"a6efc0f4dbdba6595d89cdaf2d8f26f68be16f0b","versionType":"git"},{"version":"b286a0651e4404ab96cdfdcdad8a839a26b3751e","status":"affected","lessThan":"297e96f38d3e4f1a3b84068950dd5c7a55bbdc7b","versionType":"git"},{"version":"b286a0651e4404ab96cdfdcdad8a839a26b3751e","status":"affected","lessThan":"09a9cbadc05f452405de31012bd2c428b601291a","versionType":"git"},{"version":"b286a0651e4404ab96cdfdcdad8a839a26b3751e","status":"affected","lessThan":"313f79149eb337411c64e2c247234b62ef9a3cb9","versionType":"git"},{"version":"b286a0651e4404ab96cdfdcdad8a839a26b3751e","status":"affected","lessThan":"2cb7a8d64b7e8ccdc69bbe48fe9c4eaa79c33aec","versionType":"git"},{"version":"b286a0651e4404ab96cdfdcdad8a839a26b3751e","status":"affected","lessThan":"db51a8658c11a82432b64999519a269c3aabb447","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/smc/smc.h"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.8","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.8","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.112","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.50","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.4","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/smc/smc.h"]}],"references":["https://git.kernel.org/stable/c/a6efc0f4dbdba6595d89cdaf2d8f26f68be16f0b","https://git.kernel.org/stable/c/297e96f38d3e4f1a3b84068950dd5c7a55bbdc7b","https://git.kernel.org/stable/c/09a9cbadc05f452405de31012bd2c428b601291a","https://git.kernel.org/stable/c/313f79149eb337411c64e2c247234b62ef9a3cb9","https://git.kernel.org/stable/c/2cb7a8d64b7e8ccdc69bbe48fe9c4eaa79c33aec","https://git.kernel.org/stable/c/db51a8658c11a82432b64999519a269c3aabb447"],"weaknesses":[],"ingestedAt":"2026-10-30T12:50:04.827Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/80xxx/CVE-2026-80980.json","commit":"1f312381e38164a43607eebab851b151dd16861e","baselineCommit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-80980","state":"PUBLISHED","datePublished":"2026-09-11T19:42:40.832Z","dateUpdated":"2026-10-30T12:31:33.078Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-26T14:34:25.811Z"},"containers":{"cna":{"title":"net/smc: stop killed, freed and out_of_sync sharing a byte","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: stop killed, freed and out_of_sync sharing a byte\n\nThe three connection state flags are single-bit bitfields, so they occupy\none byte of struct smc_connection and every store to one is a\nread-modify-write of the other two:\n\n    u8  killed : 1;\n    u8  freed : 1;\n    u8  out_of_sync : 1;\n\nThey are not written under a common lock. smc_cdc_msg_validate() sets\nout_of_sync from the receive tasklet, while smc_conn_kill() sets killed\nfrom process context under lock_sock(), and the receive path does not defer\nto the backlog when the socket is owned -- smc_cdc_msg_recv() takes only\nbh_lock_sock().\n\nGive each flag its own byte so a store no longer touches its neighbours.\nAll readers test them as booleans and are unchanged. struct smc_connection\ngrows by two bytes."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"b286a0651e4404ab96cdfdcdad8a839a26b3751e","status":"affected","lessThan":"a6efc0f4dbdba6595d89cdaf2d8f26f68be16f0b","versionType":"git"},{"version":"b286a0651e4404ab96cdfdcdad8a839a26b3751e","status":"affected","lessThan":"297e96f38d3e4f1a3b84068950dd5c7a55bbdc7b","versionType":"git"},{"version":"b286a0651e4404ab96cdfdcdad8a839a26b3751e","status":"affected","lessThan":"09a9cbadc05f452405de31012bd2c428b601291a","versionType":"git"},{"version":"b286a0651e4404ab96cdfdcdad8a839a26b3751e","status":"affected","lessThan":"313f79149eb337411c64e2c247234b62ef9a3cb9","versionType":"git"},{"version":"b286a0651e4404ab96cdfdcdad8a839a26b3751e","status":"affected","lessThan":"2cb7a8d64b7e8ccdc69bbe48fe9c4eaa79c33aec","versionType":"git"},{"version":"b286a0651e4404ab96cdfdcdad8a839a26b3751e","status":"affected","lessThan":"db51a8658c11a82432b64999519a269c3aabb447","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/smc/smc.h"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.8","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.8","versionType":"semver"},{"version":"6.1.191","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.160","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.112","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.50","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.4","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/smc/smc.h"]}],"references":[{"url":"https://git.kernel.org/stable/c/a6efc0f4dbdba6595d89cdaf2d8f26f68be16f0b"},{"url":"https://git.kernel.org/stable/c/297e96f38d3e4f1a3b84068950dd5c7a55bbdc7b"},{"url":"https://git.kernel.org/stable/c/09a9cbadc05f452405de31012bd2c428b601291a"},{"url":"https://git.kernel.org/stable/c/313f79149eb337411c64e2c247234b62ef9a3cb9"},{"url":"https://git.kernel.org/stable/c/2cb7a8d64b7e8ccdc69bbe48fe9c4eaa79c33aec"},{"url":"https://git.kernel.org/stable/c/db51a8658c11a82432b64999519a269c3aabb447"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL"},"scenarios":[{"lang":"en","value":"AV:N - smc_cdc_msg_validate() runs from the SMC-R CDC receive tasklet on RDMA completions, and teardown is driven by CLC DECLINE (FIRST_CONTACT) or LLC DELETE_LINK_ALL from the same peer. SMC-Rv2 is RoCEv2 over UDP/4791 (IP-routable) with the CLC handshake on plain TCP, so a remote host that can reach an AF_SMC listener hits the path.\nAC:L - The attacker controls both sides of the race: it sends CDC failover_validation messages that store out_of_sync from the receive tasklet (no sock lock) while concurrently forcing smc_conn_kill()/smc_conn_free() via CLC decline, CDC close/abort, or LLC link-delete, and can retry across many connections in the same link group.\nPR:N - SMC has no peer authentication. Completing the CLC handshake to a listening AF_SMC/IPPROTO_SMC socket and sending CDC/CLC/LLC messages requires no credentials, capabilities, or local account, matching other SMC remote bugs.\nUI:N - CDC is processed in a softirq tasklet from the RDMA completion queue and CLC decline is handled in the handshake worker; no local user or application action is required beyond the already-listening SMC server.\nS:U - The corrupted flags and resulting UAF stay inside kernel objects (smc_connection, smc_sock, smc_link_group) in the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - A lost killed/freed/out_of_sync bit from the shared-byte RMW lets CDC continue after unregister or lets smc_conn_free() run twice (duplicate smc_lgr_put), a use-after-free of the socket and link group that can be reallocated to disclose kernel memory.\nI:H - The same UAF/double-free writes through a reused smc_sock (sk_err, sk_data_ready, queue_work on abort_work/close_work) and link-group refcounts, giving heap-spray primitives for arbitrary kernel write and control-flow hijack.\nA:H - Use-after-free and double-free of the connection and link group oops or panic in softirq/workqueue context (refcount underflow, as in related SMC UAFs), and the attacker can trigger it repeatedly without authentication."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-30T12:31:33.078Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"6.1.191"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"6.6.160"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"6.12.112"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"6.18.50"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"7.2.4"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.8","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-80980","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"yes"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T19:21:47.866329Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-16T19:26:37.381Z"}}]}}}