Answer in brief
CVE-2026-99032 records a High severity (CVSS 7.8) vulnerability in net/smc: protect clcsock lifetime in smc_getname. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=b03faa1fafc8018295401dc558bdc76362d860a4 <e607017a553d2a48e428ec8b8ffb06bf3bb92ce9 || >=b03faa1fafc8018295401dc558bdc76362d860a4 <1512e3714b3946bda75a160a34f22a51710daa43 || >=b03faa1fafc8018295401dc558bdc76362d860a4 <6a1833f0d7dc037c8e876b9178ba69d5d107c086 || >=b03faa1fafc8018295401dc558bdc76362d860a4 <c223da71abfaea2ebb1c7208ae9ebf15038f9388 || >=b03faa1fafc8018295401dc558bdc76362d860a4 <64a6b36b0e1855288080bc5f89769f27d6dc03c8 || 0b6153d04c96a1d4b6284692386aa21d04d7956c || >=4.19.299 <4.20 | e607017a553d2a48e428ec8b8ffb06bf3bb92ce9, 1512e3714b3946bda75a160a34f22a51710daa43, 6a1833f0d7dc037c8e876b9178ba69d5d107c086, c223da71abfaea2ebb1c7208ae9ebf15038f9388, 64a6b36b0e1855288080bc5f89769f27d6dc03c8, 4.20 |
| Linux/Linuxgeneric | 5.1 | Not reported |
Published upstream
Oct 23, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 24, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 23, 2026
In the Linux kernel, the following vulnerability has been resolved: net/smc: protect clcsock lifetime in smc_getname smc_getname() dereferences smc->clcsock without holding clcsock_release_lock. Link-group termination can release the CLC socket through smc_close_active_abort() while the SMC socket is still open, for example after shutdown(SHUT_WR). A getsockname() caller can load smc->clcsock, then the termination worker can clear the pointer and call sock_release() before the caller accesses clcsock->ops or invokes getname(). This causes a use-after-free; if the worker clears the pointer before the load, it causes a NULL dereference. The syscall's file reference keeps the SMC socket alive but does not prevent asynchronous release of its CLC socket. KASAN reported the following with test-only timing instrumentation: BUG: KASAN: slab-use-after-free in smc_getname+0x19e/0x1b0 Read of size 8 at addr ffff888109abb4e0 by task poc/103 Call Trace: smc_getname+0x19e/0x1b0 do_getsockname+0xe5/0x170 __sys_getsockname+0x8c/0x100 Allocated by task 95: sock_alloc_inode+0x1e/0x280 sock_alloc+0x3d/0x240 __sock_create+0x7e/0x430 smc_create+0x121/0x240 Freed by task 0: kmem_cache_free+0xcc/0x340 rcu_core+0x50a/0x1850 Last potentially related work creation: evict+0x446/0x6c0 smc_clcsock_release+0xa8/0xd0 smc_close_active_abort+0x26a/0x3a0 __smc_lgr_terminate.part.0+0x137/0x2e0 Hold clcsock_release_lock across the pointer check and the getname() callback to serialize with smc_clcsock_release(). Return -EBADF if the CLC socket has already been released, preserving the existing peer state check and the callback's return value otherwise.
Quoted source text, attributed separately from HOL analysis.