In the Linux kernel, the following vulnerability has been resolved:

net/smc: fix UAF on lgr list traversal in smcr_port_err()

smcr_port_err() traverses smc_lgr_list.list without holding
smc_lgr_list.lock, allowing a concurrent smc_lgr_terminate_sched()
to free an lgr while it is still being dereferenced.

Hold smc_lgr_list.lock across the traversal. Update
smc_ib_gid_check() to call smcr_port_err() after releasing the lock.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
541afa10c126b6c22c2a805a559c70cc41fd156e affected < 34bcf11cd2528ae00bb6d764d808083c66824277
541afa10c126b6c22c2a805a559c70cc41fd156e affected < 0edcc4284392b28826b5d37532b366b291e6e0fa
541afa10c126b6c22c2a805a559c70cc41fd156e affected < 00a59600ae72d24859d0ad1783a78bc921bc2599
541afa10c126b6c22c2a805a559c70cc41fd156e affected < 3d35f069e1c119992000d51236dbe54da2d4e61e
541afa10c126b6c22c2a805a559c70cc41fd156e affected < 3d65a2eb4449fc9658fb860dea893025d028d90e
541afa10c126b6c22c2a805a559c70cc41fd156e affected < a9b968e42690d784c241a0761c10253271f7df5d
541afa10c126b6c22c2a805a559c70cc41fd156e affected < 61cb282fe97b3b0ba32ca09417a693162bf4ae3f
Linux Linux affected
Version Status Constraints
5.8 affected —
0 unaffected < 5.8
5.15.222 unaffected ≤ 5.15.*
6.1.189 unaffected ≤ 6.1.*
6.6.158 unaffected ≤ 6.6.*
6.12.112 unaffected ≤ 6.12.*
6.18.55 unaffected ≤ 6.18.*
7.2.9 unaffected ≤ 7.2.*
7.3-rc5 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/00a59600ae72d24859d0ad1783a78bc921bc2599 cve-icon cve-icon
https://git.kernel.org/stable/c/0edcc4284392b28826b5d37532b366b291e6e0fa cve-icon cve-icon
https://git.kernel.org/stable/c/34bcf11cd2528ae00bb6d764d808083c66824277 cve-icon cve-icon
https://git.kernel.org/stable/c/3d35f069e1c119992000d51236dbe54da2d4e61e cve-icon cve-icon
https://git.kernel.org/stable/c/3d65a2eb4449fc9658fb860dea893025d028d90e cve-icon cve-icon
https://git.kernel.org/stable/c/61cb282fe97b3b0ba32ca09417a693162bf4ae3f cve-icon cve-icon
https://git.kernel.org/stable/c/a9b968e42690d784c241a0761c10253271f7df5d cve-icon cve-icon
History

Sun, 18 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: net/smc: fix UAF on lgr list traversal in smcr_port_err() smcr_port_err() traverses smc_lgr_list.list without holding smc_lgr_list.lock, allowing a concurrent smc_lgr_terminate_sched() to free an lgr while it is still being dereferenced. Hold smc_lgr_list.lock across the traversal. Update smc_ib_gid_check() to call smcr_port_err() after releasing the lock.
Title net/smc: fix UAF on lgr list traversal in smcr_port_err()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-10-18T15:18:26.349Z

Reserved: 2026-09-25T10:25:14.357Z

Link: CVE-2026-98559

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-18T16:17:08.033

Modified: 2026-10-18T16:17:08.033

Link: CVE-2026-98559

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.