---
cve: "CVE-2026-80979"
severity: "HIGH"
cvss: 7.8
epss: "13%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-09-11 20:19:04"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-09-18T03:23:29+02:00"
---

# CVE-2026-80979

> 7.8 HIGH

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

net/smc: unregister the connection before draining the rx tasklet

smc_conn_free() calls smc_ism_unset_conn() only while the link group is
still on its device list, and never sets conn->killed.
smc_lgr_terminate_sched() unlinks the group immediately and defers killing
its connections to a work item, so a connection freed in that window keeps
its smcd->conn[] slot with both gates in smcd_handle_irq() open, and the
device can re-arm the receive tasklet after tasklet_kill() has returned. On
the DMB-nocopy path the ghost send buffer is freed right after that drain,
so the re-armed tasklet dereferences it.

Unregister unconditionally and drain before the detach at both teardown
sites, mirroring rmb_desc, which smc_buf_unuse() releases after the drain.
Clear conn->sndbuf_desc before freeing it as well, so a reader that samples
the pointer cannot get one that is already freed.

## CVSS-Vektor

```
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Lokal | good |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Patch verfügbar (OSV)

- Kernel ≥ 6.6.157
- Kernel ≥ 6.12.109
- Kernel ≥ 6.18.50
- Kernel ≥ 7.2.4

## Referenzen

- <https://git.kernel.org/stable/c/b6b6ac713ee82b340a8e3be30b101bd2840deec4>
- <https://git.kernel.org/stable/c/b4d540ac95cd35c6ebab6afb7eae2bcac7b277a5>
- <https://git.kernel.org/stable/c/5bd8b764a610b6b6bc0c4d3d01652747f6e0b5c3>
- <https://git.kernel.org/stable/c/b74d313567dfc1b7e56629ddbad04e728686f235>
- <https://git.kernel.org/stable/c/36cdf5d48ca191dcd71c28cadbe0981b1d25318d>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-80979) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_