---
id: CVE-2026-90065
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure

  IPPROTO_SMC sockets create an internal TCP sock ("clcsock") from the
  proto->init hook
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure

  IPPROTO_SMC sockets create an internal TCP sock ("clcsock") from the
  proto->init hook. Wh…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d25a92ccae6bed02327b63d138e12e7806830f78 <
    2f4ece7fed6d915ec64b7735962c0d84d6261032
  - >-
    Linux >= d25a92ccae6bed02327b63d138e12e7806830f78 <
    84180988a455fd8e147c6b35c8df65d8b8cc76c2
  - >-
    Linux >= d25a92ccae6bed02327b63d138e12e7806830f78 <
    94a913cd521c0f0408820bcdbd80dadf076d97b5
  - >-
    Linux >= d25a92ccae6bed02327b63d138e12e7806830f78 <
    cec261b0b4c5c0b044165303198d10ffcdf3414c
  - Linux 6.11
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:16:55.327'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90065'
references:
  - url: 'https://git.kernel.org/stable/c/2f4ece7fed6d915ec64b7735962c0d84d6261032'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/84180988a455fd8e147c6b35c8df65d8b8cc76c2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/94a913cd521c0f0408820bcdbd80dadf076d97b5'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cec261b0b4c5c0b044165303198d10ffcdf3414c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.900Z'
epss: 0.002
epssPercentile: 0.10123
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/smc: release the internal TCP sock on IPPROTO_SMC socket creation failure

IPPROTO_SMC sockets create an internal TCP sock ("clcsock") from the
proto->init hook. When socket creation fails after proto->init has
run - e.g. a cgroup BPF program attached to BPF_CGROUP_INET_SOCK_CREATE
denies the socket - sk_common_release() only invokes sk_prot->destroy
if it is set, but neither smc_inet_prot nor smc_inet6_prot defines it,
and smc_destruct() returns early unless sk_state is SMC_CLOSED. As a
result, every failing socket(AF_INET, SOCK_STREAM, IPPROTO_SMC) call
leaks one tcp_sock, so an unprivileged task able to attach a deny-all
BPF_CGROUP_INET_SOCK_CREATE program to its own cgroup can grow kernel
memory unboundedly.

Add a .destroy hook to both protos that releases the clcsock via
smc_clcsock_release(). smc_sk_init() hashes the sock into the smc
hashinfo before the clcsock is created, and smc_diag dumps walk that
hash dereferencing smc->clcsock without taking clcsock_release_lock,
while sk_common_release() calls .destroy before .unhash. Unhash the
sock before releasing the clcsock, as __smc_release() does, so a
concurrent dump cannot observe the release; the second unhash in
sk_common_release() is a no-op.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.