{"id":"CVE-2026-98559","kind":"vulnerability","aliases":["CVE-2026-98559"],"related":[],"title":"Linux kernel: SMC link-group list race can read freed memory","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix UAF on lgr list traversal in smcr_port_err()\n\nsmcr_port_err() traverses smc_lgr_list.list without holding\nsmc_lgr_list.lock, allowing a concurrent smc_lgr_terminate_sched()\nto free an lgr while it is still being dereferenced.\n\nHold smc_lgr_list.lock across the traversal. Update\nsmc_ib_gid_check() to call smcr_port_err() after releasing the lock.","summary":"The Linux kernel's SMC (Shared Memory Communications) code traversed a link-group list without holding its lock, so a concurrent termination could free an entry while it was still being read. An attacker could potentially trigger a use-after-free, the sources do not say what they can get beyond a crash or memory corruption.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["linux-kernel","rdma","runtime","smc"],"not_affected_if":["smc-module-not-loaded"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that contains the upstream commit fixing net/smc smcr_port_err() locking; the sources do not name the fixed version.","status":"open","published_at":"2026-10-18T16:17:08+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:23:24+00:00","updated_at":"2026-10-25T05:23:24+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-25T05:23:24Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that contains the upstream commit fixing net/smc smcr_port_err() locking; the sources do not name the fixed version.","reach":"unknown","title":"Linux kernel: SMC link-group list race can read freed memory","impact":"medium","summary":"The Linux kernel's SMC (Shared Memory Communications) code traversed a link-group list without holding its lock, so a concurrent termination could free an entry while it was still being read. An attacker could potentially trigger a use-after-free, the sources do not say what they can get beyond a crash or memory corruption.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","smc","rdma"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown memory corruption or kernel crash from use-after-free","analyst_note":"Check the kernel.org stable commit for net/smc smcr_port_err to confirm the fixed versions, default kernel config, and whether an unprivileged trigger exists.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["smc-module-not-loaded"],"who_is_affected":"Systems running a Linux kernel with the SMC protocol module (net/smc) built in or loaded, which is mainly hosts using SMC-R over RDMA-capable RoCE links. Machines that do not load the smc module are not affected; the sources do not say whether default distribution kernels enable it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000608,"input_tokens":3395,"output_tokens":538,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98559':15A,18A 'across':131C 'allow':112C 'attack':59B 'beyond':77B 'call':140C 'check':138C 'code':33B 'communic':32B 'concurr':46B,114C 'corrupt':82B 'could':48B,60B 'crash':79B 'cve':13A,16A 'dereferenc':128C 'entri':51B 'err':103C,106C,143C 'fix':94C 'follow':88C 'free':49B,67B,120C 'freed':11A 'get':76B 'gid':137C 'group':6A,38B 'hold':41B,110C,129C 'ib':136C 'kernel':2A,21B,27B,86C 'lgr':97C,116C,122C 'link':5A,37B 'link-group':4A,36B 'linux':1A,20B,26B,85C 'linux-kernel':19B 'list':7A,39B,98C 'lock':43B,147C 'memori':12A,31B,81B 'net/smc':93C 'port':102C,105C,142C 'potenti':61B 'race':8A 'rdma':22B 'read':10A,57B 'releas':145C 'resolv':92C 'runtim':23B 'say':72B 'sched':118C 'share':30B 'smc':3A,24B,29B,115C,135C 'smc_lgr_list.list':108C 'smc_lgr_list.lock':111C,130C 'smcr':101C,104C,141C 'sourc':69B 'still':55B,126C 'termin':47B,117C 'travers':34B,99C,107C,133C 'trigger':62B 'uaf':95C 'updat':134C 'use':65B 'use-after-fre':64B 'vulner':89C 'without':40B,109C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the SMC protocol module (net/smc) built in or loaded, which is mainly hosts using SMC-R over RDMA-capable RoCE links. Machines that do not load the smc module are not affected; the sources do not say whether default distribution kernels enable it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:08+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98559","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98559","severity":null,"published_at":"2026-10-18T16:17:08+00:00","modified_at":"2026-10-19T10:19:12+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}