GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80980 (GCVE-0-2026-80980)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:42 – Updated: 2026-09-13 06:28
VLAI
Title
net/smc: stop killed, freed and out_of_sync sharing a byte
Summary
In the Linux kernel, the following vulnerability has been resolved: net/smc: stop killed, freed and out_of_sync sharing a byte The three connection state flags are single-bit bitfields, so they occupy one byte of struct smc_connection and every store to one is a read-modify-write of the other two: u8 killed : 1; u8 freed : 1; u8 out_of_sync : 1; They are not written under a common lock. smc_cdc_msg_validate() sets out_of_sync from the receive tasklet, while smc_conn_kill() sets killed from process context under lock_sock(), and the receive path does not defer to the backlog when the socket is owned -- smc_cdc_msg_recv() takes only bh_lock_sock(). Give each flag its own byte so a store no longer touches its neighbours. All readers test them as booleans and are unchanged. struct smc_connection grows by two bytes.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b286a0651e4404ab96cdfdcdad8a839a26b3751e , < 313f79149eb337411c64e2c247234b62ef9a3cb9 (git)
Affected: b286a0651e4404ab96cdfdcdad8a839a26b3751e , < 2cb7a8d64b7e8ccdc69bbe48fe9c4eaa79c33aec (git)
Affected: b286a0651e4404ab96cdfdcdad8a839a26b3751e , < db51a8658c11a82432b64999519a269c3aabb447 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.8
Unaffected: 0 , < 5.8 (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/smc/smc.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "313f79149eb337411c64e2c247234b62ef9a3cb9",
              "status": "affected",
              "version": "b286a0651e4404ab96cdfdcdad8a839a26b3751e",
              "versionType": "git"
            },
            {
              "lessThan": "2cb7a8d64b7e8ccdc69bbe48fe9c4eaa79c33aec",
              "status": "affected",
              "version": "b286a0651e4404ab96cdfdcdad8a839a26b3751e",
              "versionType": "git"
            },
            {
              "lessThan": "db51a8658c11a82432b64999519a269c3aabb447",
              "status": "affected",
              "version": "b286a0651e4404ab96cdfdcdad8a839a26b3751e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/smc/smc.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: stop killed, freed and out_of_sync sharing a byte\n\nThe three connection state flags are single-bit bitfields, so they occupy\none byte of struct smc_connection and every store to one is a\nread-modify-write of the other two:\n\n    u8  killed : 1;\n    u8  freed : 1;\n    u8  out_of_sync : 1;\n\nThey are not written under a common lock. smc_cdc_msg_validate() sets\nout_of_sync from the receive tasklet, while smc_conn_kill() sets killed\nfrom process context under lock_sock(), and the receive path does not defer\nto the backlog when the socket is owned -- smc_cdc_msg_recv() takes only\nbh_lock_sock().\n\nGive each flag its own byte so a store no longer touches its neighbours.\nAll readers test them as booleans and are unchanged. struct smc_connection\ngrows by two bytes."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - smc_cdc_msg_validate() runs from the SMC-R CDC receive tasklet on RDMA completions, and teardown is driven by CLC DECLINE (FIRST_CONTACT) or LLC DELETE_LINK_ALL from the same peer. SMC-Rv2 is RoCEv2 over UDP/4791 (IP-routable) with the CLC handshake on plain TCP, so a remote host that can reach an AF_SMC listener hits the path.\nAC:L - The attacker controls both sides of the race: it sends CDC failover_validation messages that store out_of_sync from the receive tasklet (no sock lock) while concurrently forcing smc_conn_kill()/smc_conn_free() via CLC decline, CDC close/abort, or LLC link-delete, and can retry across many connections in the same link group.\nPR:N - SMC has no peer authentication. Completing the CLC handshake to a listening AF_SMC/IPPROTO_SMC socket and sending CDC/CLC/LLC messages requires no credentials, capabilities, or local account, matching other SMC remote bugs.\nUI:N - CDC is processed in a softirq tasklet from the RDMA completion queue and CLC decline is handled in the handshake worker; no local user or application action is required beyond the already-listening SMC server.\nS:U - The corrupted flags and resulting UAF stay inside kernel objects (smc_connection, smc_sock, smc_link_group) in the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - A lost killed/freed/out_of_sync bit from the shared-byte RMW lets CDC continue after unregister or lets smc_conn_free() run twice (duplicate smc_lgr_put), a use-after-free of the socket and link group that can be reallocated to disclose kernel memory.\nI:H - The same UAF/double-free writes through a reused smc_sock (sk_err, sk_data_ready, queue_work on abort_work/close_work) and link-group refcounts, giving heap-spray primitives for arbitrary kernel write and control-flow hijack.\nA:H - Use-after-free and double-free of the connection and link group oops or panic in softirq/workqueue context (refcount underflow, as in related SMC UAFs), and the attacker can trigger it repeatedly without authentication."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:28:46.582Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/313f79149eb337411c64e2c247234b62ef9a3cb9"
        },
        {
          "url": "https://git.kernel.org/stable/c/2cb7a8d64b7e8ccdc69bbe48fe9c4eaa79c33aec"
        },
        {
          "url": "https://git.kernel.org/stable/c/db51a8658c11a82432b64999519a269c3aabb447"
        }
      ],
      "title": "net/smc: stop killed, freed and out_of_sync sharing a byte",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80980",
    "datePublished": "2026-09-11T19:42:40.832Z",
    "dateReserved": "2026-08-26T14:34:25.811Z",
    "dateUpdated": "2026-09-13T06:28:46.582Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80980",
      "date": "2026-09-16",
      "epss": "0.00605",
      "percentile": "0.47378"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-14T15:02:27.000Z",
      "cve": "CVE-2026-80980",
      "id": "msrc_CVE-2026-80980",
      "initial_release_date": "2026-09-13T01:14:22.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net/smc: stop killed, freed and out_of_sync sharing a byte",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-80980.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80980\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:04.407\",\"lastModified\":\"2026-09-13T07:17:04.887\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/smc: stop killed, freed and out_of_sync sharing a byte\\n\\nThe three connection state flags are single-bit bitfields, so they occupy\\none byte of struct smc_connection and every store to one is a\\nread-modify-write of the other two:\\n\\n    u8  killed : 1;\\n    u8  freed : 1;\\n    u8  out_of_sync : 1;\\n\\nThey are not written under a common lock. smc_cdc_msg_validate() sets\\nout_of_sync from the receive tasklet, while smc_conn_kill() sets killed\\nfrom process context under lock_sock(), and the receive path does not defer\\nto the backlog when the socket is owned -- smc_cdc_msg_recv() takes only\\nbh_lock_sock().\\n\\nGive each flag its own byte so a store no longer touches its neighbours.\\nAll readers test them as booleans and are unchanged. struct smc_connection\\ngrows by two bytes.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/smc/smc.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b286a0651e4404ab96cdfdcdad8a839a26b3751e\",\"lessThan\":\"313f79149eb337411c64e2c247234b62ef9a3cb9\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b286a0651e4404ab96cdfdcdad8a839a26b3751e\",\"lessThan\":\"2cb7a8d64b7e8ccdc69bbe48fe9c4eaa79c33aec\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b286a0651e4404ab96cdfdcdad8a839a26b3751e\",\"lessThan\":\"db51a8658c11a82432b64999519a269c3aabb447\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/smc/smc.h\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.8\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.8\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2cb7a8d64b7e8ccdc69bbe48fe9c4eaa79c33aec\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/313f79149eb337411c64e2c247234b62ef9a3cb9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/db51a8658c11a82432b64999519a269c3aabb447\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T19:08:36+00:00",
      "cve": "CVE-2026-80980",
      "id": "CVE-2026-80980",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "234",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/smc: stop killed, freed and out_of_sync sharing a byte",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80980.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T01:04:51Z",
      "cve": "CVE-2026-80980",
      "id": "CVE-2026-80980",
      "initial_release_date": "2026-09-12T16:36:20Z",
      "product_status:known_affected": "236",
      "product_status:known_not_affected": "117",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80980",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80980.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.