---
id: CVE-2026-98559
title: 'net/smc: fix UAF on lgr list traversal in smcr_port_err()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/smc: fix UAF on lgr list traversal in smcr_port_err()

  smcr_port_err() traverses smc_lgr_list.list without holding
  smc_lgr_list.lock, allowing a concurrent smc_lgr_…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 541afa10c126b6c22c2a805a559c70cc41fd156e <
    34bcf11cd2528ae00bb6d764d808083c66824277
  - >-
    Linux >= 541afa10c126b6c22c2a805a559c70cc41fd156e <
    0edcc4284392b28826b5d37532b366b291e6e0fa
  - >-
    Linux >= 541afa10c126b6c22c2a805a559c70cc41fd156e <
    00a59600ae72d24859d0ad1783a78bc921bc2599
  - >-
    Linux >= 541afa10c126b6c22c2a805a559c70cc41fd156e <
    3d35f069e1c119992000d51236dbe54da2d4e61e
  - >-
    Linux >= 541afa10c126b6c22c2a805a559c70cc41fd156e <
    3d65a2eb4449fc9658fb860dea893025d028d90e
  - >-
    Linux >= 541afa10c126b6c22c2a805a559c70cc41fd156e <
    a9b968e42690d784c241a0761c10253271f7df5d
  - >-
    Linux >= 541afa10c126b6c22c2a805a559c70cc41fd156e <
    61cb282fe97b3b0ba32ca09417a693162bf4ae3f
  - Linux 5.8
published: '2026-10-18'
updated: '2026-10-18'
sourceUpdated: '2026-10-18T15:18:26.349Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-98559'
references:
  - url: 'https://git.kernel.org/stable/c/34bcf11cd2528ae00bb6d764d808083c66824277'
  - url: 'https://git.kernel.org/stable/c/0edcc4284392b28826b5d37532b366b291e6e0fa'
  - url: 'https://git.kernel.org/stable/c/00a59600ae72d24859d0ad1783a78bc921bc2599'
  - url: 'https://git.kernel.org/stable/c/3d35f069e1c119992000d51236dbe54da2d4e61e'
  - url: 'https://git.kernel.org/stable/c/3d65a2eb4449fc9658fb860dea893025d028d90e'
  - url: 'https://git.kernel.org/stable/c/a9b968e42690d784c241a0761c10253271f7df5d'
  - url: 'https://git.kernel.org/stable/c/61cb282fe97b3b0ba32ca09417a693162bf4ae3f'
tags:
  - cve.org
ingestedAt: '2026-10-18T15:45:12.262Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/smc: fix UAF on lgr list traversal in smcr_port_err()

smcr_port_err() traverses smc_lgr_list.list without holding
smc_lgr_list.lock, allowing a concurrent smc_lgr_terminate_sched()
to free an lgr while it is still being dereferenced.

Hold smc_lgr_list.lock across the traversal. Update
smc_ib_gid_check() to call smcr_port_err() after releasing the lock.

## Affected

- `Linux >= 541afa10c126b6c22c2a805a559c70cc41fd156e < 34bcf11cd2528ae00bb6d764d808083c66824277`
- `Linux >= 541afa10c126b6c22c2a805a559c70cc41fd156e < 0edcc4284392b28826b5d37532b366b291e6e0fa`
- `Linux >= 541afa10c126b6c22c2a805a559c70cc41fd156e < 00a59600ae72d24859d0ad1783a78bc921bc2599`
- `Linux >= 541afa10c126b6c22c2a805a559c70cc41fd156e < 3d35f069e1c119992000d51236dbe54da2d4e61e`
- `Linux >= 541afa10c126b6c22c2a805a559c70cc41fd156e < 3d65a2eb4449fc9658fb860dea893025d028d90e`
- `Linux >= 541afa10c126b6c22c2a805a559c70cc41fd156e < a9b968e42690d784c241a0761c10253271f7df5d`
- `Linux >= 541afa10c126b6c22c2a805a559c70cc41fd156e < 61cb282fe97b3b0ba32ca09417a693162bf4ae3f`
- `Linux 5.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.