SB20260912395 - Missing Release of Resource after Effective Lifetime in Linux kernel smc

Description

This security bulletin contains information about 1 vulnerability.

1) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-80983)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to improper resource management in smc_switch_conns() when handling connection switches during SMC link failover. A local user can initiate a connection switch during link failover to cause a denial of service.

The target link must go down or the connection must be killed while the switch is in progress.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/719296c4aa8213d4ac8002e77d5956d436bc98d0
• https://git.kernel.org/stable/c/84dea0585f6b538ae895a8b1d025f4897737f3b1
• https://git.kernel.org/stable/c/d89dc1bd8845c669a700eee58c64ebd3cc1b6d2d
• https://git.kernel.org/stable/c/d9a879ac25958bdaecb669ce70e58f8e2ff170de