CVE-2026-80982

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the smc rx pipe buf release() function. A race condition occurs when smc rx splice() provides RMB pages to a pipe while a concurrent close operation triggers smc conn free(), which releases the receive buffer back to the link group pool. Because smc rx pipe buf release() checks the socket state before acquiring the socket lock, the state may change in the interim. This leads smc rx update cons() to dereference conn->rmb desc and access conn->lgr after they have been released by smc conn free(). In the is reg err path, smcr buf unuse() frees the descriptor, resulting in a use-after-free that could allow local privilege escalation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.