CVE-2026-80981

In the Linux kernel, the following vulnerability has been resolved:

net/smc: fix use-after-free of the LLC qentry in smcllcsrvaddlink()

smcllcsrvaddlink() keeps add_llc pointing into the queue entry:

  addllc = &qentry->msg.addlink; smc_llc.c:1482

  ...

  smcllcsaveaddlinkinfo(linknew, addllc); smcllc.c:1494

  smcllcflowqentrydel(&lgr->llcflowlcl); smc_llc.c:1495

  ...

  u8 *llcmsg = smclinksharedv2_rxbuf(link) ?

(u8 *)lgr->wrrxbufv2 : (u8 *)addllc; smc_llc.c:1504

  smcllcsaveaddlinkrkeys(link, linknew, llcmsg); smcllc.c:1506

smcllcflowqentrydel() kfree()s the entry, so on a link without a shared

v2 receive buffer the pointer handed to smcllcsaveaddlink_rkeys() is

already freed. Before the Fixes: commit that branch always used

lgr->wrrxbufv2 and addllc was not used after the free.

Reproduced on an unpatched tree over rxe, with KASAN, kasanmultishot

and a link forced to maxrecvsge == 1: the entry is freed and read by

the same call, and the freeing frame is smcllcsrvaddlink() itself.

  [    2.523161] BUG: KASAN: slab-use-after-free in smcllcsaveaddlink_rkeys+0x333/0x350

  [    2.523499] Read of size 2 at addr ffff8880052194de by task kworker/0:1/11

  [    2.523789]

  [    2.523862] CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 7.2.0-rc5-p0-g2c9dd296545d #35 PREEMPT(lazy)

  [    2.523865] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014

  [    2.523866] Workqueue: smchswq smclistenwork

  [    2.523869] Call Trace:

  [    2.523870]  <TASK>

  [    2.523871]  dumpstacklvl+0x53/0x70

  [    2.523872]  print_report+0xd0/0x630

  [    2.523874]  ? pfxrawspinlock_irqsave+0x10/0x10

  [    2.523876]  ? smcllcsaveaddlink_rkeys+0x333/0x350

  [    2.523878]  kasan_report+0xce/0x100

  [    2.523879]  ? smcllcsaveaddlink_rkeys+0x333/0x350

  [    2.523881]  smcllcsaveaddlink_rkeys+0x333/0x350

  [    2.523883]  ? smcrbufreg_lgr+0x2a4/0x660

  [    2.523885]  smcllcsrvaddlink+0xaa2/0x1e50

  [    2.523888]  ? _printk+0xba/0xf0

  [    2.523897]  ? _pfxsmcllcsrvaddlink+0x10/0x10

  [    2.523899]  ? down_write+0xb0/0x130

  [    2.523903]  ? _pfxdown_write+0x10/0x10

  [    2.523905]  smclistenwork+0x489e/0x4d00

  [    2.523907]  ? kmemcachefree+0x1c6/0x3a0

  [    2.523911]  ? _pfxsmclistenwork+0x10/0x10

  [    2.523913]  ? release_sock+0x148/0x1d0

  [    2.523915]  ? smctcplisten_work+0xb4f/0xfc0

  [    2.523917]  ? rawspinlockirq+0x80/0xe0

  [    2.523918]  ? pfxrawspinlock_irq+0x10/0x10

  [    2.523920]  processonework+0x633/0x1030

  [    2.523922]  ? assign_work+0x11d/0x370

  [    2.523924]  worker_thread+0x45b/0xd10

  [    2.523926]  ? _pfxworker_thread+0x10/0x10

  [    2.523928]  ? _pfxworker_thread+0x10/0x10

  [    2.523929]  kthread+0x2c6/0x3b0

  [    2.523931]  ? recalc_sigpending+0x15c/0x1e0

  [    2.523934]  ? _pfxkthread+0x10/0x10

  [    2.523935]  retfromfork+0x36e/0x5a0

  [    2.523937]  ? _pfxretfromfork+0x10/0x10

  [    2.523938]  ? _switchto+0x572/0xdd0

  [    2.523943]  ? _pfxkthread+0x10/0x10

  [    2.523944]  retfromfork_asm+0x1a/0x30

  [    2.523947]  </TASK>

  [    2.523948]

  [    2.531253] Allocated by task 48:

  [    2.531399]  kasansavestack+0x33/0x60

  [    2.531570]  kasansavetrack+0x14/0x30

  [    2.531737]  _kasankmalloc+0x8f/0xa0

  [    2.531905]  _kmalloccache_noprof+0x158/0x370

  [    2.532100]  smcllcenqueue+0x72/0x560

  [    2.532268]  smcwrrxtaskletfn+0x474/0xa80

  [    2.532491]  taskletactioncommon+0x20f/0x8a0

  [    2.532714]  handle_softirqs+0x18e/0x590

  [    2.532886]  do_softirq+0x3b/0x60

  [    2.533036]  _localbhenableip+0x61/0x70

  [    2.533221]  _allocskb+0x732/0x890

  [    2.533384]  rxeinitpacket+0x16b/0x4f0

  [    2.533567]  prepareackpacket+0xb8/0x830

  [    2.533760]  rxe_receiver+0x495/0x96e0

  [    2.533933]  do_work+0x144/0x470

  [    2

---truncated---