CVE-2026-80984

In the Linux kernel, the following vulnerability has been resolved:

net/smc: do not dereference an unset send buffer on the SMC-D teardown path

smc close stream wait() calls smc tx prepared sends() from inside its sk wait event() condition, and sk wait event() evaluates that condition once with the socket lock released. smcd buf detach() clears conn->sndbuf desc from smc conn kill() under lock sock(), so a link group terminating while a socket waits there leaves the helper dereferencing NULL, faulting out of close(). SIOCOUTQ reads the field by hand, and smc close cancel work() drops the lock across two cancel * sync() calls.

Sample the pointer once in the helper, report nothing prepared while it is unset, and bound the ioctl the same way. The receive tasklet dereferences the field directly in smc cdc msg recv action(), not through this helper; 1/2 is what keeps it from running that late.