CVE-2026-52941

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A NULL pointer dereference exists in the smc msg event tracepoint class, which is shared by smc tx sendmsg() and smc rx recvmsg(). The issue occurs because the system unconditionally dereferences smc->conn.lnk to access ibname. While conn->lnk is set for SMC-R, it remains NULL for SMC-D. When the tracepoint is enabled, the first sendmsg() or recvmsg() call on an SMC-D socket triggers a general protection fault. Although enabling the tracepoint requires root privileges, the trigger can be activated by an unprivileged user as socket(AF SMC, ...) lacks capability checks and SMC-D negotiation does not require administrative steps on s390 or x86 with the loopback ISM device loaded.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.