net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-74719
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-08-22 16:16:46 UTC
Updated2026-08-22 16:16:46 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() The SMC_LLC_CONFIRM_LINK / SMC_LLC_ADD_LINK_CONT branch in smc_llc_event_handler() stores an incoming qentry into the local LLC flow without first checking whether a qentry is already pending. If a malicious or buggy peer sends a second CONFIRM_LINK or ADD_LINK_CONT request while a flow is active and flow->qentry is already set, smc_llc_flow_qentry_set() overwrites the pointer without freeing the previous allocation, leaking one kmalloc-96 object per spurious message. The sibling SMC_LLC_DELETE_LINK branch already has the correct !flow->qentry guard. Apply the same guard to the CONFIRM_LINK/ADD_LINK_CONT branch so that a duplicate message when qentry is already occupied falls through to break and is freed by the kfree(qentry) at the out: label, rather than silently leaking the existing allocation. The response direction (smc_llc_rx_response()) is unaffected: it already guards with flow->qentry at the equivalent site and drops duplicate responses correctly.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 e384f3cba6ea709f5b2272b1770db4ce14047f78 git Not specified
CNA Linux Linux affected 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 a1e980d7a9e7ee6faf4f5fd7b450413b969af26d git Not specified
CNA Linux Linux affected 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 e0eb87677c76b157cdf8eb7c1f19e56227165a33 git Not specified
CNA Linux Linux affected 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 06734dfeaeba886aab1bf147249195b888ac3e4d git Not specified
CNA Linux Linux affected 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 c23c409228629107203d3c3e95fff1473173f1a6 git Not specified
CNA Linux Linux affected 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 10cb31b2b74cb664c6c95cf72364d7d5c483ab82 git Not specified
CNA Linux Linux affected 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 bfc336a9fbbf09805f3dfe25c195a4db90af2846 git Not specified
CNA Linux Linux affected 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 976245094925bab9bc39366b2e9ab44ffcde61d0 git Not specified
CNA Linux Linux affected 5.8 Not specified
CNA Linux Linux unaffected 5.8 semver Not specified
CNA Linux Linux unaffected 5.10.265 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.216 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.183 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.152 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.104 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.45 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.9 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/c23c409228629107203d3c3e95fff1473173f1a6 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/bfc336a9fbbf09805f3dfe25c195a4db90af2846 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/976245094925bab9bc39366b2e9ab44ffcde61d0 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/e0eb87677c76b157cdf8eb7c1f19e56227165a33 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/e384f3cba6ea709f5b2272b1770db4ce14047f78 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/10cb31b2b74cb664c6c95cf72364d7d5c483ab82 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/06734dfeaeba886aab1bf147249195b888ac3e4d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/a1e980d7a9e7ee6faf4f5fd7b450413b969af26d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report