CVE-2026-80981

In the Linux kernel, the following vulnerability has been resolved:

net/smc: fix use-after-free of the LLC qentry in smc llc srv add link()

smc llc srv add link() keeps add llc pointing into the queue entry:

add llc = &qentry->msg.add link; smc llc.c:1482 ... smc llc save add link info(link new, add llc); smc llc.c:1494 smc llc flow qentry del(&lgr->llc flow lcl); smc llc.c:1495 ... u8 *llc msg = smc link shared v2 rxbuf(link) ? (u8 *)lgr->wr rx buf v2 : (u8 *)add llc; smc llc.c:1504 smc llc save add link rkeys(link, link new, llc msg); smc llc.c:1506

smc llc flow qentry del() kfree()s the entry, so on a link without a shared v2 receive buffer the pointer handed to smc llc save add link rkeys() is already freed. Before the Fixes: commit that branch always used lgr->wr rx buf v2 and add llc was not used after the free.

Reproduced on an unpatched tree over rxe, with KASAN, kasan multi shot and a link forced to max recv sge == 1: the entry is freed and read by the same call, and the freeing frame is smc llc srv add link() itself.

[ 2.523161] BUG: KASAN: slab-use-after-free in smc llc save add link rkeys+0x333/0x350 [ 2.523499] Read of size 2 at addr ffff8880052194de by task kworker/0:1/11 [ 2.523789] [ 2.523862] CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 7.2.0-rc5-p0-g2c9dd296545d #35 PREEMPT(lazy) [ 2.523865] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2.523866] Workqueue: smc hs wq smc listen work [ 2.523869] Call Trace: [ 2.523870] [ 2.523871] dump stack lvl+0x53/0x70 [ 2.523872] print report+0xd0/0x630 [ 2.523874] ? pfx raw spin lock irqsave+0x10/0x10 [ 2.523876] ? smc llc save add link rkeys+0x333/0x350 [ 2.523878] kasan report+0xce/0x100 [ 2.523879] ? smc llc save add link rkeys+0x333/0x350 [ 2.523881] smc llc save add link rkeys+0x333/0x350 [ 2.523883] ? smcr buf reg lgr+0x2a4/0x660 [ 2.523885] smc llc srv add link+0xaa2/0x1e50 [ 2.523888] ? printk+0xba/0xf0 [ 2.523897] ? pfx smc llc srv add link+0x10/0x10 [ 2.523899] ? down write+0xb0/0x130 [ 2.523903] ? pfx down write+0x10/0x10 [ 2.523905] smc listen work+0x489e/0x4d00 [ 2.523907] ? kmem cache free+0x1c6/0x3a0 [ 2.523911] ? pfx smc listen work+0x10/0x10 [ 2.523913] ? release sock+0x148/0x1d0 [ 2.523915] ? smc tcp listen work+0xb4f/0xfc0 [ 2.523917] ? raw spin lock irq+0x80/0xe0 [ 2.523918] ? pfx raw spin lock irq+0x10/0x10 [ 2.523920] process one work+0x633/0x1030 [ 2.523922] ? assign work+0x11d/0x370 [ 2.523924] worker thread+0x45b/0xd10 [ 2.523926] ? pfx worker thread+0x10/0x10 [ 2.523928] ? pfx worker thread+0x10/0x10 [ 2.523929] kthread+0x2c6/0x3b0 [ 2.523931] ? recalc sigpending+0x15c/0x1e0 [ 2.523934] ? pfx kthread+0x10/0x10 [ 2.523935] ret from fork+0x36e/0x5a0 [ 2.523937] ? pfx ret from fork+0x10/0x10 [ 2.523938] ? switch to+0x572/0xdd0 [ 2.523943] ? pfx kthread+0x10/0x10 [ 2.523944] ret from fork asm+0x1a/0x30 [ 2.523947] [ 2.523948] [ 2.531253] Allocated by task 48: [ 2.531399] kasan save stack+0x33/0x60 [ 2.531570] kasan save track+0x14/0x30 [ 2.531737] kasan kmalloc+0x8f/0xa0 [ 2.531905] kmalloc cache noprof+0x158/0x370 [ 2.532100] smc llc enqueue+0x72/0x560 [ 2.532268] smc wr rx tasklet fn+0x474/0xa80 [ 2.532491] tasklet action common+0x20f/0x8a0 [ 2.532714] handle softirqs+0x18e/0x590 [ 2.532886] do softirq+0x3b/0x60 [ 2.533036] local bh enable ip+0x61/0x70 [ 2.533221] alloc skb+0x732/0x890 [ 2.533384] rxe init packet+0x16b/0x4f0 [ 2.533567] prepare ack packet+0xb8/0x830 [ 2.533760] rxe receiver+0x495/0x96e0 [ 2.533933] do work+0x144/0x470 [ 2 ---truncated---