Answer in brief
CVE-2026-52941 records a Medium severity (CVSS 5.5) vulnerability in net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 5.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=aff3083f10bff7a37eaa2b4e6bc5fb627ddd5f84 <68200112534bb2acd1d7117dc2d5c124868d866d || >=aff3083f10bff7a37eaa2b4e6bc5fb627ddd5f84 <720c76b930c52cd58f50eb6b10569d03dccc7959 || >=aff3083f10bff7a37eaa2b4e6bc5fb627ddd5f84 <b706d6d76a2a2793fe5ad0fbc2a75b6a460094ef || >=aff3083f10bff7a37eaa2b4e6bc5fb627ddd5f84 <d2ea0b8aef8746e147602eac87ca8538f4bc7e66 || >=aff3083f10bff7a37eaa2b4e6bc5fb627ddd5f84 <561cf66fa9b6c86dfe4e687d2d1aeaaa6739917f || >=aff3083f10bff7a37eaa2b4e6bc5fb627ddd5f84 <7bf563badd37cb796df5477d2b78bb64148a1268 | 68200112534bb2acd1d7117dc2d5c124868d866d, 720c76b930c52cd58f50eb6b10569d03dccc7959, b706d6d76a2a2793fe5ad0fbc2a75b6a460094ef, d2ea0b8aef8746e147602eac87ca8538f4bc7e66, 561cf66fa9b6c86dfe4e687d2d1aeaaa6739917f, 7bf563badd37cb796df5477d2b78bb64148a1268 |
| Linux/Linuxgeneric | 5.16 | Not reported |
Published upstream
Jun 24, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 6, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 24, 2026
In the Linux kernel, the following vulnerability has been resolved: net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint The smc_msg_event tracepoint class, shared by smc_tx_sendmsg and smc_rx_recvmsg, unconditionally dereferences smc->conn.lnk: __string(name, smc->conn.lnk->ibname) conn->lnk is only set for SMC-R; for SMC-D it is NULL. Other code on these paths already handles this (e.g. !conn->lnk in SMC_STAT_RMB_TX_SIZE_SMALL()). With the tracepoint enabled, the first sendmsg()/recvmsg() on an SMC-D socket crashes: Oops: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [...] RIP: 0010:strlen+0x1e/0xa0 Call Trace: trace_event_raw_event_smc_msg_event (net/smc/smc_tracepoint.h:44) smc_rx_recvmsg (net/smc/smc_rx.c:515) smc_recvmsg (net/smc/af_smc.c:2859) __sys_recvfrom (net/socket.c:2315) __x64_sys_recvfrom (net/socket.c:2326) do_syscall_64 The faulting address 0x3e0 is offsetof(struct smc_link, ibname), confirming the NULL ->lnk deref. Enabling the tracepoint requires root, but the trigger itself is unprivileged: socket(AF_SMC, ...) has no capability check, and SMC-D negotiation needs no admin step on s390 or on x86 with the loopback ISM device loaded. Log an empty device name for SMC-D instead of dereferencing NULL.
Quoted source text, attributed separately from HOL analysis.