CVE-2026-99032— net/smc: protect clcsock lifetime in smc_getname
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Linux 内核中，以下漏洞已得到修复： net/smc：在 smc_getname 中保护 clcsock 的生命周期 函数在未持有 锁的情况下解引用了 。当 SMC 套接字仍处于打开状态时（例如在执行 之后），链接组（link-group）终止流程可能通过 释放 CLC 套接字。 的调用者可能会先加载 指针，随后终止工作线程（termination worker）在调用者访问 或执行 回调之前，先将该指针清零并调用 。这会导致“释放后使用”（use-after-free）漏洞；如果工作线程在指针加载之前将其
Possible ATT&CK Techniques 1 AI
T1068 · Exploitation for Privilege EscalationAffected Version Matrix 14
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | b03faa1fafc8018295401dc558bdc76362d860a4< e607017a553d2a48e428ec8b8ffb06bf3bb92ce9 |
affected |
b03faa1fafc8018295401dc558bdc76362d860a4< 1512e3714b3946bda75a160a34f22a51710daa43 |
affected | ||
b03faa1fafc8018295401dc558bdc76362d860a4< 6a1833f0d7dc037c8e876b9178ba69d5d107c086 |
affected | ||
b03faa1fafc8018295401dc558bdc76362d860a4< c223da71abfaea2ebb1c7208ae9ebf15038f9388 |
affected | ||
b03faa1fafc8018295401dc558bdc76362d860a4< 64a6b36b0e1855288080bc5f89769f27d6dc03c8 |
affected | ||
0b6153d04c96a1d4b6284692386aa21d04d7956c |
affected | ||
4.19.299< 4.20 |
affected | ||
5.1 |
affected | ||
| … +6 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-99032
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
net/smc: protect clcsock lifetime in smc_getname
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
net/smc: protect clcsock lifetime in smc_getname
smc_getname() dereferences smc->clcsock without holding
clcsock_release_lock. Link-group termination can release the CLC socket
through smc_close_active_abort() while the SMC socket is still open,
for example after shutdown(SHUT_WR).
A getsockname() caller can load smc->clcsock, then the termination worker
can clear the pointer and call sock_release() before the caller accesses
clcsock->ops or invokes getname(). This causes a use-after-free; if the
worker clears the pointer before the load, it causes a NULL dereference.
The syscall's file reference keeps the SMC socket alive but does not
prevent asynchronous release of its CLC socket.
KASAN reported the following with test-only timing instrumentation:
BUG: KASAN: slab-use-after-free in smc_getname+0x19e/0x1b0
Read of size 8 at addr ffff888109abb4e0 by task poc/103
Call Trace:
smc_getname+0x19e/0x1b0
do_getsockname+0xe5/0x170
__sys_getsockname+0x8c/0x100
Allocated by task 95:
sock_alloc_inode+0x1e/0x280
sock_alloc+0x3d/0x240
__sock_create+0x7e/0x430
smc_create+0x121/0x240
Freed by task 0:
kmem_cache_free+0xcc/0x340
rcu_core+0x50a/0x1850
Last potentially related work creation:
evict+0x446/0x6c0
smc_clcsock_release+0xa8/0xd0
smc_close_active_abort+0x26a/0x3a0
__smc_lgr_terminate.part.0+0x137/0x2e0
Hold clcsock_release_lock across the pointer check and the getname()
callback to serialize with smc_clcsock_release(). Return -EBADF if the
CLC socket has already been released, preserving the existing peer
state check and the callback's return value otherwise.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-99032
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-99032
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-99032 (4)
Same Patch Batch · Linux · 2026-10-23 · 218 CVEs total
| CVE-2026-98959 | 9.8 CRITICAL | btrfs: fix xattr replace when multiple xattrs are packed in the same item |
| CVE-2026-99079 | 9.8 CRITICAL | net/mlx5e: Prevent stale XSK buffer release on refill retry |
| CVE-2026-99078 | 9.8 CRITICAL | net/mlx5e: Prevent stale XSK buffer release on MPWQE refill retry |
| CVE-2026-98870 | 8.8 HIGH | ksmbd: remove stale channels from all sessions on teardown |
| CVE-2026-98980 | 8.8 HIGH | namei: don't reveal overmounted entries in refwalk |
| CVE-2026-99083 | 8.8 HIGH | ksmbd: fix heap out-of-bounds write in krb5_authenticate() |
| CVE-2026-99082 | 8.8 HIGH | KVM: x86: Use active memslots for the per-vCPU MMIO cache |
| CVE-2026-98981 | 8.8 HIGH | namespace: unhash a dentry before detaching the mounts on it |
| CVE-2026-98988 | 8.8 HIGH | namespace: keep covered mounts covered in OPEN_TREE_NAMESPACE |
| CVE-2026-98978 | 8.4 HIGH | namespace: never expire a locked mount |
| CVE-2026-99042 | 8.4 HIGH | io_uring/net: populate CONNECT filter fields for 24-byte sockaddr_in6 |
| CVE-2026-99064 | 8.1 HIGH | cipso: adjust cached option offsets when removing CIPSO |
| CVE-2026-98968 | 8.1 HIGH | amt: send the relay's General Query directly from the receive path |
| CVE-2026-99053 | 7.8 HIGH | tipc: hold a reference to nodes found by link name |
| CVE-2026-99050 | 7.8 HIGH | gpio: mpsse: fix race when arming the IRQ poll worker |
| CVE-2026-99051 | 7.8 HIGH | fsverity: RCU-delay the freeing of struct fsverity_info |
| CVE-2026-98974 | 7.8 HIGH | xfs: fix exchange-range-to-eof file size exchange |
| CVE-2026-98999 | 7.8 HIGH | drm/xe: Fix stale pinned_link entry when fb-pin performs the final unpin |
| CVE-2026-99056 | 7.8 HIGH | strparser: make sure __strp_recv isn't running before tearing down the parser |
| CVE-2026-98889 | 7.8 HIGH | wifi: iwlwifi: mvm: fix sched scan IE sizing |
Showing top 20 of 218 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-99087
dm-integrity: fix NULL pointer dereference when the 'R' flag -
CVE-2026-99086
dm-integrity: validate the superblock on resume -
CVE-2026-99084
readdir: take no inode lock on an immutable directory -
CVE-2026-99085
sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit -
CVE-2026-99083
ksmbd: fix heap out-of-bounds write in krb5_authenticate()
Same vendor: Linux
-
CVE-2026-99087
dm-integrity: fix NULL pointer dereference when the 'R' flag -
CVE-2026-99086
dm-integrity: validate the superblock on resume -
CVE-2026-99084
readdir: take no inode lock on an immutable directory -
CVE-2026-99085
sched_ext: Fix CPU hotplug hang when a dying CPU's tasks sit -
CVE-2026-99083
ksmbd: fix heap out-of-bounds write in krb5_authenticate()