CVE-2026-64541: Critical Vulnerability in Linux Kernel

Q: Introduction A critical vulnerability has been identified in the Linux kernel that may affect system stability and security. This vulnerability relates to socket reference management, potentially leading to unexpected system behavior. What happened?

The vulnerability resides in the smc_cdc_rx_handler() function, which looks up the connection by token under the conns_lock. After releasing the lock, the function attempts to dereference a connection and an associated socket, which can result in accessing freed memory if the connection is closed by another process during that interval.

Q: Which versions are affected?

linux kernel ≥ 4.18 < 5.10.261 linux kernel ≥ 5.11 < 5.15.212 linux kernel ≥ 5.16 < 6.1.178 linux kernel ≥ 6.2 < 6.6.145 linux kernel ≥ 6.7 < 6.12.97 linux kernel ≥ 6.13 < 6.18.40 linux kernel ≥ 6.19 < 7.1.5 linux kernel 7.2

Introduction

A critical vulnerability has been identified in the Linux kernel that may affect system stability and security. This vulnerability relates to socket reference management, potentially leading to unexpected system behavior.

What happened?

The vulnerability resides in the smc_cdc_rx_handler() function, which looks up the connection by token under the conns_lock. After releasing the lock, the function attempts to dereference a connection and an associated socket, which can result in accessing freed memory if the connection is closed by another process during that interval.

How does the vulnerability work?

The vulnerability is classified as a use-after-free (UAF), where the smc_cdc_rx_handler() function does not hold a reference to the socket after releasing the lock. This allows a concurrent connection closure to free the socket memory, potentially leading to a kernel panic.

What is the real impact?

The impact of the vulnerability can be severe, resulting in kernel panic and, consequently, system unavailability. Only SMC-R is affected, while SMC-D is not vulnerable due to protective mechanisms that prevent concurrent execution during connection release.

Which versions are affected?

linux kernel ≥ 4.18 < 5.10.261
linux kernel ≥ 5.11 < 5.15.212
linux kernel ≥ 5.16 < 6.1.178
linux kernel ≥ 6.2 < 6.6.145
linux kernel ≥ 6.7 < 6.12.97
linux kernel ≥ 6.13 < 6.18.40
linux kernel ≥ 6.19 < 7.1.5
linux kernel 7.2

How to fix

Check your Linux kernel version.
Update to a patched version of the kernel as indicated by the vendor.
Reboot the system after the update to ensure changes are applied.
Monitor kernel security advisories for future updates and patches.

Mitigation while you update

While an update is not possible, consider limiting access to services using SMC-R and monitoring the system for anomalous behavior that may indicate exploitation of the vulnerability.

Conclusion

It is crucial for system administrators and server owners to check and update their Linux kernel versions to mitigate this critical vulnerability and ensure the security and stability of their systems.

// Fontes