UBUNTU-CVE-2026-23450
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() Syzkaller reported a panic in smc_tcp_syn_recv_sock() [1]. smc_tcp_syn_recv_sock() is called in the TCP receive path (softirq) via icsk_af_ops->syn_recv_sock on the clcsock (TCP listening socket). It reads sk_user_data to get the smc_sock pointer. However, when the SMC listen socket is being closed concurrently, smc_close_active() sets clcsock->sk_user_data to NULL under sk_callback_lock, and then the smc_sock itself can be freed via sock_put() in smc_release(). This leads to two issues: 1) NULL pointer dereference: sk_user_data is NULL when accessed. 2) Use-after-free: sk_user_data is read as non-NULL, but the smc_sock is freed before its fields (e.g., queued_smc_hs, ori_af_ops) are accessed. The race window looks like this (the syzkaller crash [1] triggers via the SYN cookie path: tcp_get_cookie_sock() -> smc_tcp_syn_recv_sock(), but the normal tcp_check_req() path has the same race): CPU A (softirq) CPU B (process ctx) tcp_v4_rcv() TCP_NEW_SYN_RECV: sk = req->rsk_listener sock_hold(sk) /* No lock on listener */ smc_close_active(): write_lock_bh(cb_lock) sk_user_data = NULL write_unlock_bh(cb_lock) ... smc_clcsock_release() sock_put(smc->sk) x2 -> smc_sock freed! tcp_check_req() smc_tcp_syn_recv_sock(): smc = user_data(sk) -> NULL or dangling smc->queued_smc_hs -> crash! Note that the clcsock and smc_sock are two independent objects with separate refcounts. TCP stack holds a reference on the clcsock, which keeps it alive, but this does NOT prevent the smc_sock from being freed. Fix this by using RCU and refcount_inc_not_zero() to safely access smc_sock. Since smc_tcp_syn_recv_sock() is called in the TCP three-way handshake path, taking read_lock_bh on sk_callback_lock is too heavy and would not survive a SYN flood attack. Using rcu_read_lock() is much more lightweight. - Set SOCK_RCU_FREE on the SMC listen socket so that smc_sock freeing is deferred until after the RCU grace period. This guarantees the memory is still valid when accessed inside rcu_read_lock(). - Use rcu_read_lock() to protect reading sk_user_data. - Use refcount_inc_not_zero(&smc->sk.sk_refcnt) to pin the smc_sock. If the refcount has already reached zero (close path completed), it returns false and we bail out safely. Note: smc_hs_congested() has a similar lockless read of sk_user_data without rcu_read_lock(), but it only checks for NULL and accesses the global smc_hs_wq, never dereferencing any smc_sock field, so it is not affected. Reproducer was verified with mdelay injection and smc_run, the issue no longer occurs with this patch applied. [1] https://syzkaller.appspot.com/bug?extid=827ae2bfb3a3529333e9
02 / AFFECTED SOFTWARE
Affected packages
11 explicit affected versions
86 explicit affected versions
50 explicit affected versions
6 explicit affected versions
12 explicit affected versions
19 explicit affected versions
10 explicit affected versions
6 explicit affected versions
96 explicit affected versions
58 explicit affected versions
24 explicit affected versions
81 explicit affected versions
82 explicit affected versions
83 explicit affected versions
75 explicit affected versions
10 explicit affected versions
36 explicit affected versions
26 explicit affected versions
88 explicit affected versions
7 explicit affected versions
83 explicit affected versions
39 explicit affected versions
13 explicit affected versions
43 explicit affected versions
35 explicit affected versions
48 explicit affected versions
46 explicit affected versions
18 explicit affected versions
39 explicit affected versions
64 explicit affected versions
44 explicit affected versions
13 explicit affected versions
4 explicit affected versions
23 explicit affected versions
51 explicit affected versions
1 explicit affected versions
21 explicit affected versions
7 explicit affected versions
16 explicit affected versions
10 explicit affected versions
19 explicit affected versions
47 explicit affected versions
8 explicit affected versions
7 explicit affected versions
12 explicit affected versions
11 explicit affected versions
7 explicit affected versions
12 explicit affected versions
14 explicit affected versions
10 explicit affected versions
1 explicit affected versions
7 explicit affected versions
16 explicit affected versions
12 explicit affected versions
7 explicit affected versions
12 explicit affected versions
40 explicit affected versions
42 explicit affected versions
16 explicit affected versions
16 explicit affected versions
27 explicit affected versions
33 explicit affected versions
10 explicit affected versions
37 explicit affected versions
10 explicit affected versions
8 explicit affected versions
13 explicit affected versions
38 explicit affected versions
3 explicit affected versions
10 explicit affected versions
11 explicit affected versions
64 explicit affected versions
26 explicit affected versions
9 explicit affected versions
13 explicit affected versions
33 explicit affected versions
29 explicit affected versions
13 explicit affected versions
12 explicit affected versions
94 explicit affected versions
40 explicit affected versions
39 explicit affected versions
8 explicit affected versions
88 explicit affected versions
51 explicit affected versions
33 explicit affected versions
23 explicit affected versions
57 explicit affected versions
10 explicit affected versions
19 explicit affected versions
18 explicit affected versions
11 explicit affected versions
5 explicit affected versions
12 explicit affected versions
8 explicit affected versions
7 explicit affected versions
12 explicit affected versions
7 explicit affected versions
16 explicit affected versions
5 explicit affected versions
73 explicit affected versions
89 explicit affected versions
10 explicit affected versions
26 explicit affected versions
39 explicit affected versions
65 explicit affected versions
35 explicit affected versions
46 explicit affected versions
11 explicit affected versions
8 explicit affected versions
13 explicit affected versions
45 explicit affected versions
16 explicit affected versions
87 explicit affected versions
49 explicit affected versions
3 explicit affected versions
7 explicit affected versions
14 explicit affected versions
51 explicit affected versions
15 explicit affected versions
18 explicit affected versions
41 explicit affected versions
12 explicit affected versions
69 explicit affected versions
76 explicit affected versions
5 explicit affected versions
27 explicit affected versions
62 explicit affected versions
42 explicit affected versions
8 explicit affected versions
53 explicit affected versions
5 explicit affected versions
8 explicit affected versions
10 explicit affected versions
7 explicit affected versions
45 explicit affected versions
13 explicit affected versions
13 explicit affected versions
7 explicit affected versions
8 explicit affected versions
10 explicit affected versions
12 explicit affected versions
9 explicit affected versions
35 explicit affected versions
44 explicit affected versions
16 explicit affected versions
3 explicit affected versions
13 explicit affected versions
26 explicit affected versions
45 explicit affected versions
37 explicit affected versions
49 explicit affected versions
14 explicit affected versions
38 explicit affected versions
9 explicit affected versions
16 explicit affected versions
11 explicit affected versions
38 explicit affected versions
17 explicit affected versions
13 explicit affected versions
89 explicit affected versions
6 explicit affected versions
7 explicit affected versions
4 explicit affected versions
78 explicit affected versions
8 explicit affected versions
1 explicit affected versions
87 explicit affected versions
77 explicit affected versions
77 explicit affected versions
13 explicit affected versions
43 explicit affected versions
13 explicit affected versions
10 explicit affected versions
8 explicit affected versions
44 explicit affected versions
14 explicit affected versions
4 explicit affected versions
78 explicit affected versions
13 explicit affected versions
11 explicit affected versions
1 explicit affected versions
18 explicit affected versions
38 explicit affected versions
76 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix NULL dereference and UAF in smc_tcp_syn_recv_sock() Syzkaller reported a panic in smc_tcp_syn_recv_sock() [1]. smc_tcp_syn_recv_sock() is called in the TCP receive path (softirq) via icsk_af_ops->syn_recv_sock on the clcsock (TCP listening socket). It reads sk_user_data to get the smc_sock pointer. However, when the SMC listen socket is being closed concurrently, smc_close_active() sets clcsock->sk_user_data to NULL under sk_callback_lock, and then the smc_sock itself can be freed via sock_put() in smc_release(). This leads to two issues: 1) NULL pointer dereference: sk_user_data is NULL when accessed. 2) Use-after-free: sk_user_data is read as non-NULL, but the smc_sock is freed before its fields (e.g., queued_smc_hs, ori_af_ops) are accessed. The race window looks like this (the syzkaller crash [1] triggers via the SYN cookie path: tcp_get_cookie_sock() -> smc_tcp_syn_recv_sock(), but the normal tcp_check_req() path has the same race): CPU A (softirq) CPU B (process ctx) tcp_v4_rcv() TCP_NEW_SYN_RECV: sk = req->rsk_listener sock_hold(sk) /* No lock on listener */ smc_close_active(): write_lock_bh(cb_lock) sk_user_data = NULL write_unlock_bh(cb_lock) ... smc_clcsock_release() sock_put(smc->sk) x2 -> smc_sock freed! tcp_check_req() smc_tcp_syn_recv_sock(): smc = user_data(sk) -> NULL or dangling smc->queued_smc_hs -> crash! Note that the clcsock and smc_sock are two independent objects with separate refcounts. TCP stack holds a reference on the clcsock, which keeps it alive, but this does NOT prevent the smc_sock from being freed. Fix this by using RCU and refcount_inc_not_zero() to safely access smc_sock. Since smc_tcp_syn_recv_sock() is called in the TCP three-way handshake path, taking read_lock_bh on sk_callback_lock is too heavy and would not survive a SYN flood attack. Using rcu_read_lock() is much more lightweight. - Set SOCK_RCU_FREE on the SMC listen socket so that smc_sock freeing is deferred until after the RCU grace period. This guarantees the memory is still valid when accessed inside rcu_read_lock(). - Use rcu_read_lock() to protect reading sk_user_data. - Use refcount_inc_not_zero(&smc->sk.sk_refcnt) to pin the smc_sock. If the refcount has already reached zero (close path completed), it returns false and we bail out safely. Note: smc_hs_congested() has a similar lockless read of sk_user_data without rcu_read_lock(), but it only checks for NULL and accesses the global smc_hs_wq, never dereferencing any smc_sock field, so it is not affected. Reproducer was verified with mdelay injection and smc_run, the issue no longer occurs with this patch applied. [1] https://syzkaller.appspot.com/bug?extid=827ae2bfb3a3529333e9
05 / REFERENCES
Further evidence
- https://git.kernel.org/linus/6d5e4538364b9ceb1ac2941a4deb86650afb3538
- https://git.kernel.org/stable/c/1e4f873879e075bbd4eb1c644d6933303ac5eba4
- https://git.kernel.org/stable/c/1fab5ece76fb42a761178dcd0ebcbf578377b0dd
- https://git.kernel.org/stable/c/6d5e4538364b9ceb1ac2941a4deb86650afb3538
- https://git.kernel.org/stable/c/cadf3da46c15523fba90d80c9955f536ee3b4023
- https://git.kernel.org/stable/c/f00fc26c8a06442b225a350fe000c0a11483e6a3
- https://git.kernel.org/stable/c/fd7579f0a2c84ba8a7d4f206201b50dc8ddf90c2
- https://ubuntu.com/security/CVE-2026-23450
- https://ubuntu.com/security/notices/USN-8490-1
- https://ubuntu.com/security/notices/USN-8490-2
- https://ubuntu.com/security/notices/USN-8491-1
- https://ubuntu.com/security/notices/USN-8492-1
- https://ubuntu.com/security/notices/USN-8492-2
- https://ubuntu.com/security/notices/USN-8492-3
- https://ubuntu.com/security/notices/USN-8492-4
- https://ubuntu.com/security/notices/USN-8492-5
- https://ubuntu.com/security/notices/USN-8493-1
- https://ubuntu.com/security/notices/USN-8493-2
- https://ubuntu.com/security/notices/USN-8497-1
- https://ubuntu.com/security/notices/USN-8498-1
- https://ubuntu.com/security/notices/USN-8499-1
- https://ubuntu.com/security/notices/USN-8508-1
- https://ubuntu.com/security/notices/USN-8527-1
- https://ubuntu.com/security/notices/USN-8528-1
- https://ubuntu.com/security/notices/USN-8545-1
- https://ubuntu.com/security/notices/USN-8546-1
- https://ubuntu.com/security/notices/USN-8547-1
- https://ubuntu.com/security/notices/USN-8547-2
- https://ubuntu.com/security/notices/USN-8604-1
- https://ubuntu.com/security/notices/USN-8605-1
- https://ubuntu.com/security/notices/USN-8606-1
- https://ubuntu.com/security/notices/USN-8607-1
- https://ubuntu.com/security/notices/USN-8609-1
- https://ubuntu.com/security/notices/USN-8619-1
- https://www.cve.org/CVERecord?id=CVE-2026-23450