Answer in brief
CVE-2026-64048 records a High severity (CVSS 7.5) vulnerability in net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.5. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=a7c9c5f4af7f6098da68705fc5d86565d0728ef7 <6927cacf2b10d4fa80c1a2d407512ef9397c59c6 || >=a7c9c5f4af7f6098da68705fc5d86565d0728ef7 <d38ba387244e5c5f7db3e11ea98bc2c7beccb0c0 || >=a7c9c5f4af7f6098da68705fc5d86565d0728ef7 <53eb7bd09aace72fa17510d80e0caf5ca058c231 || >=a7c9c5f4af7f6098da68705fc5d86565d0728ef7 <afa9036b8c9963947b487c36e332df6a42c96fcb || >=a7c9c5f4af7f6098da68705fc5d86565d0728ef7 <65edb3b0822cfe5041be8fbabebd57e2e5ad9f4e || >=a7c9c5f4af7f6098da68705fc5d86565d0728ef7 <277740023def559a4a2ddc3e8e784ee37a0f16a9 | 6927cacf2b10d4fa80c1a2d407512ef9397c59c6, d38ba387244e5c5f7db3e11ea98bc2c7beccb0c0, 53eb7bd09aace72fa17510d80e0caf5ca058c231, afa9036b8c9963947b487c36e332df6a42c96fcb, 65edb3b0822cfe5041be8fbabebd57e2e5ad9f4e, 277740023def559a4a2ddc3e8e784ee37a0f16a9 |
| Linux/Linuxgeneric | 5.10 | Not reported |
| Linux/Linuxgeneric | >=a7c9c5f4af7f6098da68705fc5d86565d0728ef7 <903f7688ffeb9b323d70652c01f554bd4ba2a3d6 || >=a7c9c5f4af7f6098da68705fc5d86565d0728ef7 <dd2f9dd83c68abd7ba7ded7075290b016cb7ecd0 || >=a7c9c5f4af7f6098da68705fc5d86565d0728ef7 <6927cacf2b10d4fa80c1a2d407512ef9397c59c6 || >=a7c9c5f4af7f6098da68705fc5d86565d0728ef7 <d38ba387244e5c5f7db3e11ea98bc2c7beccb0c0 || >=a7c9c5f4af7f6098da68705fc5d86565d0728ef7 <53eb7bd09aace72fa17510d80e0caf5ca058c231 || >=a7c9c5f4af7f6098da68705fc5d86565d0728ef7 <afa9036b8c9963947b487c36e332df6a42c96fcb || >=a7c9c5f4af7f6098da68705fc5d86565d0728ef7 <65edb3b0822cfe5041be8fbabebd57e2e5ad9f4e || >=a7c9c5f4af7f6098da68705fc5d86565d0728ef7 <277740023def559a4a2ddc3e8e784ee37a0f16a9 | 903f7688ffeb9b323d70652c01f554bd4ba2a3d6, dd2f9dd83c68abd7ba7ded7075290b016cb7ecd0, 6927cacf2b10d4fa80c1a2d407512ef9397c59c6, d38ba387244e5c5f7db3e11ea98bc2c7beccb0c0, 53eb7bd09aace72fa17510d80e0caf5ca058c231, afa9036b8c9963947b487c36e332df6a42c96fcb, 65edb3b0822cfe5041be8fbabebd57e2e5ad9f4e, 277740023def559a4a2ddc3e8e784ee37a0f16a9 |
Published upstream
Jul 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot On the SMC-D client, slot 0 of ini->ism_dev[]/ini->ism_chid[] is reserved for an SMC-Dv1 device. smc_find_ism_v2_device_clnt() populates V2 entries starting at index 1, so when no V1 device is selected slot 0 is left in its kzalloc()'ed state with ism_dev[0] == NULL and ism_chid[0] == 0. smc_v2_determine_accepted_chid() then matches the peer's CHID against the array starting from index 0 using the CHID alone. A malicious peer replying to a SMC-Dv2-only proposal with d1.chid == 0 matches the empty slot, ini->ism_selected becomes 0, and the subsequent ism_dev[0]->lgr_lock dereference in smc_conn_create() faults at offsetof(struct smcd_dev, lgr_lock) == 0x68: BUG: KASAN: null-ptr-deref in _raw_spin_lock_bh+0x79/0xe0 Write of size 4 at addr 0000000000000068 by task exploit/144 Call Trace: _raw_spin_lock_bh smc_conn_create (net/smc/smc_core.c:1997) __smc_connect (net/smc/af_smc.c:1447) smc_connect (net/smc/af_smc.c:1720) __sys_connect __x64_sys_connect do_syscall_64 Require ism_dev[i] to be non-NULL before accepting a CHID match.
Quoted source text, attributed separately from HOL analysis.