256 lines
14 KiB
JSON
256 lines
14 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2026-80980",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2026-08-26T14:34:25.811Z",
|
|
"datePublished": "2026-09-11T19:42:40.832Z",
|
|
"dateUpdated": "2026-10-30T12:31:33.078Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-10-30T12:31:33.078Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: stop killed, freed and out_of_sync sharing a byte\n\nThe three connection state flags are single-bit bitfields, so they occupy\none byte of struct smc_connection and every store to one is a\nread-modify-write of the other two:\n\n u8 killed : 1;\n u8 freed : 1;\n u8 out_of_sync : 1;\n\nThey are not written under a common lock. smc_cdc_msg_validate() sets\nout_of_sync from the receive tasklet, while smc_conn_kill() sets killed\nfrom process context under lock_sock(), and the receive path does not defer\nto the backlog when the socket is owned -- smc_cdc_msg_recv() takes only\nbh_lock_sock().\n\nGive each flag its own byte so a store no longer touches its neighbours.\nAll readers test them as booleans and are unchanged. struct smc_connection\ngrows by two bytes."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 9.8,
|
|
"baseSeverity": "CRITICAL"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:N - smc_cdc_msg_validate() runs from the SMC-R CDC receive tasklet on RDMA completions, and teardown is driven by CLC DECLINE (FIRST_CONTACT) or LLC DELETE_LINK_ALL from the same peer. SMC-Rv2 is RoCEv2 over UDP/4791 (IP-routable) with the CLC handshake on plain TCP, so a remote host that can reach an AF_SMC listener hits the path.\nAC:L - The attacker controls both sides of the race: it sends CDC failover_validation messages that store out_of_sync from the receive tasklet (no sock lock) while concurrently forcing smc_conn_kill()/smc_conn_free() via CLC decline, CDC close/abort, or LLC link-delete, and can retry across many connections in the same link group.\nPR:N - SMC has no peer authentication. Completing the CLC handshake to a listening AF_SMC/IPPROTO_SMC socket and sending CDC/CLC/LLC messages requires no credentials, capabilities, or local account, matching other SMC remote bugs.\nUI:N - CDC is processed in a softirq tasklet from the RDMA completion queue and CLC decline is handled in the handshake worker; no local user or application action is required beyond the already-listening SMC server.\nS:U - The corrupted flags and resulting UAF stay inside kernel objects (smc_connection, smc_sock, smc_link_group) in the same security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - A lost killed/freed/out_of_sync bit from the shared-byte RMW lets CDC continue after unregister or lets smc_conn_free() run twice (duplicate smc_lgr_put), a use-after-free of the socket and link group that can be reallocated to disclose kernel memory.\nI:H - The same UAF/double-free writes through a reused smc_sock (sk_err, sk_data_ready, queue_work on abort_work/close_work) and link-group refcounts, giving heap-spray primitives for arbitrary kernel write and control-flow hijack.\nA:H - Use-after-free and double-free of the connection and link group oops or panic in softirq/workqueue context (refcount underflow, as in related SMC UAFs), and the attacker can trigger it repeatedly without authentication."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"net/smc/smc.h"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "b286a0651e4404ab96cdfdcdad8a839a26b3751e",
|
|
"lessThan": "a6efc0f4dbdba6595d89cdaf2d8f26f68be16f0b",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "b286a0651e4404ab96cdfdcdad8a839a26b3751e",
|
|
"lessThan": "297e96f38d3e4f1a3b84068950dd5c7a55bbdc7b",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "b286a0651e4404ab96cdfdcdad8a839a26b3751e",
|
|
"lessThan": "09a9cbadc05f452405de31012bd2c428b601291a",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "b286a0651e4404ab96cdfdcdad8a839a26b3751e",
|
|
"lessThan": "313f79149eb337411c64e2c247234b62ef9a3cb9",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "b286a0651e4404ab96cdfdcdad8a839a26b3751e",
|
|
"lessThan": "2cb7a8d64b7e8ccdc69bbe48fe9c4eaa79c33aec",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "b286a0651e4404ab96cdfdcdad8a839a26b3751e",
|
|
"lessThan": "db51a8658c11a82432b64999519a269c3aabb447",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"net/smc/smc.h"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "5.8",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "5.8",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.191",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.6.160",
|
|
"lessThanOrEqual": "6.6.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.12.112",
|
|
"lessThanOrEqual": "6.12.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.18.50",
|
|
"lessThanOrEqual": "6.18.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.2.4",
|
|
"lessThanOrEqual": "7.2.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "7.3",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.8",
|
|
"versionEndExcluding": "6.1.191"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.8",
|
|
"versionEndExcluding": "6.6.160"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.8",
|
|
"versionEndExcluding": "6.12.112"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.8",
|
|
"versionEndExcluding": "6.18.50"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.8",
|
|
"versionEndExcluding": "7.2.4"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "5.8",
|
|
"versionEndExcluding": "7.3"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/a6efc0f4dbdba6595d89cdaf2d8f26f68be16f0b"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/297e96f38d3e4f1a3b84068950dd5c7a55bbdc7b"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/09a9cbadc05f452405de31012bd2c428b601291a"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/313f79149eb337411c64e2c247234b62ef9a3cb9"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/2cb7a8d64b7e8ccdc69bbe48fe9c4eaa79c33aec"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/db51a8658c11a82432b64999519a269c3aabb447"
|
|
}
|
|
],
|
|
"title": "net/smc: stop killed, freed and out_of_sync sharing a byte",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"id": "CVE-2026-80980",
|
|
"role": "CISA Coordinator",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "yes"
|
|
},
|
|
{
|
|
"Technical Impact": "total"
|
|
}
|
|
],
|
|
"version": "2.0.3",
|
|
"timestamp": "2026-10-16T19:21:47.866329Z"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2026-10-16T19:26:37.381Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |