{"id":"CVE-2026-46027","title":"net/smc: avoid early lgr access in smc_clc_wait_msg","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: avoid early lgr access in smc_clc_wait_msg\n\nA CLC decline can be received while the handshake is still in an early\nstage, before the connection has been associ…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 0cfdd8f92cac01afbb12e4500514036a2b78756b < 257cdf0c5ced9c0fba8aba501d94b0a5fcef2086","Linux >= 0cfdd8f92cac01afbb12e4500514036a2b78756b < 22546729b96fc873b23065dc49e3d73c45cfb874","Linux >= 0cfdd8f92cac01afbb12e4500514036a2b78756b < 5eedbfd82c2884e0010fdfb3c9446a6ebcadb691","Linux >= 0cfdd8f92cac01afbb12e4500514036a2b78756b < f0858e1d5624bb120b198f2a8528f97a9b0ae069","Linux >= 0cfdd8f92cac01afbb12e4500514036a2b78756b < 6180a296ca65b08a81914805cbc0f78da5f10a1f","Linux >= 0cfdd8f92cac01afbb12e4500514036a2b78756b < ea0b5d0fe96356dce38f98375a57c52a04e13712","Linux >= 0cfdd8f92cac01afbb12e4500514036a2b78756b < 83bcf9228b0501694fb2589ed1d142855a2887f2","Linux >= 0cfdd8f92cac01afbb12e4500514036a2b78756b < 5a8db80f721deee8e916c2cfdee78decda02ce4f","Linux 4.11"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-16T15:18:59.897964Z"},"published":"2026-05-27","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:20:48.950Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-46027","references":[{"url":"https://git.kernel.org/stable/c/257cdf0c5ced9c0fba8aba501d94b0a5fcef2086"},{"url":"https://git.kernel.org/stable/c/22546729b96fc873b23065dc49e3d73c45cfb874"},{"url":"https://git.kernel.org/stable/c/5eedbfd82c2884e0010fdfb3c9446a6ebcadb691"},{"url":"https://git.kernel.org/stable/c/f0858e1d5624bb120b198f2a8528f97a9b0ae069"},{"url":"https://git.kernel.org/stable/c/6180a296ca65b08a81914805cbc0f78da5f10a1f"},{"url":"https://git.kernel.org/stable/c/ea0b5d0fe96356dce38f98375a57c52a04e13712"},{"url":"https://git.kernel.org/stable/c/83bcf9228b0501694fb2589ed1d142855a2887f2"},{"url":"https://git.kernel.org/stable/c/5a8db80f721deee8e916c2cfdee78decda02ce4f"}],"tags":["cve.org"],"epss":0.00716,"epssPercentile":0.52842,"ingestedAt":"2026-10-16T17:24:46.703Z","slug":"CVE-2026-46027","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: avoid early lgr access in smc_clc_wait_msg\n\nA CLC decline can be received while the handshake is still in an early\nstage, before the connection has been associated with a link group.\n\nThe decline handling in smc_clc_wait_msg() updates link-group level sync\nstate for first-contact declines, but that state only exists after link\ngroup setup has completed. Guard the link-group update accordingly and\nkeep the per-socket peer diagnosis handling unchanged.\n\nThis preserves the existing sync_err handling for established link-group\ncontexts and avoids touching link-group state before it is available.\n\n## Affected\n\n- `Linux >= 0cfdd8f92cac01afbb12e4500514036a2b78756b < 257cdf0c5ced9c0fba8aba501d94b0a5fcef2086`\n- `Linux >= 0cfdd8f92cac01afbb12e4500514036a2b78756b < 22546729b96fc873b23065dc49e3d73c45cfb874`\n- `Linux >= 0cfdd8f92cac01afbb12e4500514036a2b78756b < 5eedbfd82c2884e0010fdfb3c9446a6ebcadb691`\n- `Linux >= 0cfdd8f92cac01afbb12e4500514036a2b78756b < f0858e1d5624bb120b198f2a8528f97a9b0ae069`\n- `Linux >= 0cfdd8f92cac01afbb12e4500514036a2b78756b < 6180a296ca65b08a81914805cbc0f78da5f10a1f`\n- `Linux >= 0cfdd8f92cac01afbb12e4500514036a2b78756b < ea0b5d0fe96356dce38f98375a57c52a04e13712`\n- `Linux >= 0cfdd8f92cac01afbb12e4500514036a2b78756b < 83bcf9228b0501694fb2589ed1d142855a2887f2`\n- `Linux >= 0cfdd8f92cac01afbb12e4500514036a2b78756b < 5a8db80f721deee8e916c2cfdee78decda02ce4f`\n- `Linux 4.11`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}