Use-after-free in Linux kernel - CVE-2026-74493

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in __smc_lgr_terminate() in the SMC networking subsystem when terminating a link group while a concurrent close unregisters a connection. A local user can trigger overlapping close and link group termination operations to cause a denial of service.

The issue is caused by a race condition involving socket reference handling for a connection stored in lgr->conns_all.

Affected software

How to mitigate CVE-2026-74493

External References

• https://git.kernel.org/stable/c/281c103a8eaed59001ce952f231df1b07674215a
• https://git.kernel.org/stable/c/5a42f162b857019a4c10ff687dc3bcdf51831865
• https://git.kernel.org/stable/c/f0541a775d04c88e90ba448e35ce0d743512822a
• https://git.kernel.org/stable/c/f621d6ebeebb6374342571e4ddf45fdbc420f6cd
• https://git.kernel.org/stable/c/f807a63d0d95680c34f677700da9148a07d7c78f

Related Security Bulletins

• Use-after-free in Linux kernel smc
• Debian update for linux