CVE-2026-74493

In the Linux kernel, the following vulnerability has been resolved:

net/smc: fix socket use-after-free during link group termination

_smclgrterminate() drops connslock after finding a connection in

lgr->conns_all, but before taking a reference on its socket. The connection

is embedded in the socket, and its registration reference protects it only

while the connection remains in the tree.

A concurrent close can unregister the connection and drop that reference,

freeing the socket before the termination worker reaches sock_hold().

The race is reachable when close overlaps link group termination.

Local stress testing reproduced the use-after-free and KASAN reported:

  BUG: KASAN: slab-use-after-free in _smclgr_terminate.part.0 [smc]

  Write of size 4 by task kworker/3:3

  Workqueue: events smclgrterminate_work [smc]

  _smclgr_terminate.part.0 [smc]

The socket was allocated by smc_create(), freed through

slabfreeafterrcudebug(), and was followed by:

  refcount_t: addition on 0; use-after-free.

  _smclgr_terminate.part.0 [smc]

Take the socket reference while conns_lock still protects the tree entry.

The unregister path then cannot drop the last reference until termination

has finished using the socket.