---
id: CVE-2026-74493
title: 'net/smc: fix socket use-after-free during link group termination'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/smc: fix socket use-after-free during link group termination

  __smc_lgr_terminate() drops conns_lock after finding a connection in
  lgr->conns_all, but before taking…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 69318b5215f2dc32c345a3d65b98b4b1bf29c007 <
    ff44f2df57fb5560bdc75eb977867643e764a262
  - >-
    Linux >= 69318b5215f2dc32c345a3d65b98b4b1bf29c007 <
    9fb17c95b8f0683570fca1fb2792264147af937a
  - >-
    Linux >= 69318b5215f2dc32c345a3d65b98b4b1bf29c007 <
    bea8dc14de2d56aca749d368563e6888217710a5
  - >-
    Linux >= 69318b5215f2dc32c345a3d65b98b4b1bf29c007 <
    5a42f162b857019a4c10ff687dc3bcdf51831865
  - >-
    Linux >= 69318b5215f2dc32c345a3d65b98b4b1bf29c007 <
    281c103a8eaed59001ce952f231df1b07674215a
  - >-
    Linux >= 69318b5215f2dc32c345a3d65b98b4b1bf29c007 <
    f807a63d0d95680c34f677700da9148a07d7c78f
  - >-
    Linux >= 69318b5215f2dc32c345a3d65b98b4b1bf29c007 <
    f0541a775d04c88e90ba448e35ce0d743512822a
  - >-
    Linux >= 69318b5215f2dc32c345a3d65b98b4b1bf29c007 <
    f621d6ebeebb6374342571e4ddf45fdbc420f6cd
  - Linux 5.5
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T18:58:11.763137Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:05:50.062Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74493'
references:
  - url: 'https://git.kernel.org/stable/c/ff44f2df57fb5560bdc75eb977867643e764a262'
  - url: 'https://git.kernel.org/stable/c/9fb17c95b8f0683570fca1fb2792264147af937a'
  - url: 'https://git.kernel.org/stable/c/bea8dc14de2d56aca749d368563e6888217710a5'
  - url: 'https://git.kernel.org/stable/c/5a42f162b857019a4c10ff687dc3bcdf51831865'
  - url: 'https://git.kernel.org/stable/c/281c103a8eaed59001ce952f231df1b07674215a'
  - url: 'https://git.kernel.org/stable/c/f807a63d0d95680c34f677700da9148a07d7c78f'
  - url: 'https://git.kernel.org/stable/c/f0541a775d04c88e90ba448e35ce0d743512822a'
  - url: 'https://git.kernel.org/stable/c/f621d6ebeebb6374342571e4ddf45fdbc420f6cd'
tags:
  - cve.org
epss: 0.005
epssPercentile: 0.41445
ingestedAt: '2026-10-16T19:46:24.353Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/smc: fix socket use-after-free during link group termination

__smc_lgr_terminate() drops conns_lock after finding a connection in
lgr->conns_all, but before taking a reference on its socket. The connection
is embedded in the socket, and its registration reference protects it only
while the connection remains in the tree.

A concurrent close can unregister the connection and drop that reference,
freeing the socket before the termination worker reaches sock_hold().

The race is reachable when close overlaps link group termination.
Local stress testing reproduced the use-after-free and KASAN reported:

  BUG: KASAN: slab-use-after-free in __smc_lgr_terminate.part.0 [smc]
  Write of size 4 by task kworker/3:3
  Workqueue: events smc_lgr_terminate_work [smc]
  __smc_lgr_terminate.part.0 [smc]

The socket was allocated by smc_create(), freed through
slab_free_after_rcu_debug(), and was followed by:

  refcount_t: addition on 0; use-after-free.
  __smc_lgr_terminate.part.0 [smc]

Take the socket reference while conns_lock still protects the tree entry.
The unregister path then cannot drop the last reference until termination
has finished using the socket.

## Affected

- `Linux >= 69318b5215f2dc32c345a3d65b98b4b1bf29c007 < ff44f2df57fb5560bdc75eb977867643e764a262`
- `Linux >= 69318b5215f2dc32c345a3d65b98b4b1bf29c007 < 9fb17c95b8f0683570fca1fb2792264147af937a`
- `Linux >= 69318b5215f2dc32c345a3d65b98b4b1bf29c007 < bea8dc14de2d56aca749d368563e6888217710a5`
- `Linux >= 69318b5215f2dc32c345a3d65b98b4b1bf29c007 < 5a42f162b857019a4c10ff687dc3bcdf51831865`
- `Linux >= 69318b5215f2dc32c345a3d65b98b4b1bf29c007 < 281c103a8eaed59001ce952f231df1b07674215a`
- `Linux >= 69318b5215f2dc32c345a3d65b98b4b1bf29c007 < f807a63d0d95680c34f677700da9148a07d7c78f`
- `Linux >= 69318b5215f2dc32c345a3d65b98b4b1bf29c007 < f0541a775d04c88e90ba448e35ce0d743512822a`
- `Linux >= 69318b5215f2dc32c345a3d65b98b4b1bf29c007 < f621d6ebeebb6374342571e4ddf45fdbc420f6cd`
- `Linux 5.5`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.