CVE-2026-80982

In the Linux kernel, the following vulnerability has been resolved:

net/smc: fix use-after-free in smc rx pipe buf release()

smc rx splice() hands RMB pages to a pipe and takes a socket reference per entry so the smc sock stays alive until the reader finishes. The connection does not: a concurrent close runs smc conn free(), which releases the receive buffer back to the link group pool.

smc rx pipe buf release() tests sk state before taking the socket lock. The state can change between the test and the lock, and smc rx update cons() then dereferences conn->rmb desc and walks conn->lgr, which smc conn free() has already released. On the is reg err path smcr buf unuse() frees the descriptor outright, so this is a use-after-free.

Take the socket lock first and test conn->freed instead. smc conn free() sets that flag before releasing anything, and every caller holds the socket lock. The two paths exclude each other: either the pipe release runs first with everything valid, or it sees the flag and skips the update.