CVE-2026-74719
Description
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler() The SMC_LLC_CONFIRM_LINK / SMC_LLC_ADD_LINK_CONT branch in smc_llc_event_handler() stores an incoming qentry into the local LLC flow without first checking whether a qentry is already pending. If a malicious or buggy peer sends a second CONFIRM_LINK or ADD_LINK_CONT request while a flow is active and flow->qentry is already set, smc_llc_flow_qentry_set() overwrites the pointer without freeing the previous allocation, leaking one kmalloc-96 object per spurious message. The sibling SMC_LLC_DELETE_LINK branch already has the correct !flow->qentry guard. Apply the same guard to the CONFIRM_LINK/ADD_LINK_CONT branch so that a duplicate message when qentry is already occupied falls through to break and is freed by the kfree(qentry) at the out: label, rather than silently leaking the existing allocation. The response direction (smc_llc_rx_response()) is unaffected: it already guards with flow->qentry at the equivalent site and drops duplicate responses correctly.
How to fix
- Linux Linuxe384f3cba6ea709f5b2272b1770db4ce14047f78, a1e980d7a9e7ee6faf4f5fd7b450413b969af26d, e0eb87677c76b157cdf8eb7c1f19e56227165a33, 06734dfeaeba886aab1bf147249195b888ac3e4d, c23c409228629107203d3c3e95fff1473173f1a6, 10cb31b2b74cb664c6c95cf72364d7d5c483ab82, bfc336a9fbbf09805f3dfe25c195a4db90af2846, 976245094925bab9bc39366b2e9ab44ffcde61d0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 ≤ v < e384f3cba6ea709f5b2272b1770db4ce14047f78, 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 ≤ v < a1e980d7a9e7ee6faf4f5fd7b450413b969af26d, 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 ≤ v < e0eb87677c76b157cdf8eb7c1f19e56227165a33, 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 ≤ v < 06734dfeaeba886aab1bf147249195b888ac3e4d, 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 ≤ v < c23c409228629107203d3c3e95fff1473173f1a6, 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 ≤ v < 10cb31b2b74cb664c6c95cf72364d7d5c483ab82, 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 ≤ v < bfc336a9fbbf09805f3dfe25c195a4db90af2846, 0fb0b02bd6fd26cba38002be4a6bbcae2228fd44 ≤ v < 976245094925bab9bc39366b2e9ab44ffcde61d0, 5.8 | e384f3cba6ea709f5b2272b1770db4ce14047f78, a1e980d7a9e7ee6faf4f5fd7b450413b969af26d, e0eb87677c76b157cdf8eb7c1f19e56227165a33, 06734dfeaeba886aab1bf147249195b888ac3e4d, c23c409228629107203d3c3e95fff1473173f1a6, 10cb31b2b74cb664c6c95cf72364d7d5c483ab82, bfc336a9fbbf09805f3dfe25c195a4db90af2846, 976245094925bab9bc39366b2e9ab44ffcde61d0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.