CVE-2026-80980

In the Linux kernel, the following vulnerability has been resolved:

net/smc: stop killed, freed and outofsync sharing a byte

The three connection state flags are single-bit bitfields, so they occupy

one byte of struct smc_connection and every store to one is a

read-modify-write of the other two:

    u8  killed : 1;

    u8  freed : 1;

    u8  outofsync : 1;

They are not written under a common lock. smccdcmsg_validate() sets

outofsync from the receive tasklet, while smcconnkill() sets killed

from process context under lock_sock(), and the receive path does not defer

to the backlog when the socket is owned -- smccdcmsg_recv() takes only

bhlocksock().

Give each flag its own byte so a store no longer touches its neighbours.

All readers test them as booleans and are unchanged. struct smc_connection

grows by two bytes.