High 7.5Published Jul 19, 2026

CVE-2026-64048net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot

Updated under an hour ago (2026-10-19 08:00 UTC)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot On the SMC-D client, slot 0 of ini->ism_dev[]/ini->ism_chid[] is reserved for an SMC-Dv1 device. smc_find_ism_v2_device_clnt() populates V2 entries starting at index 1, so when no V1 device is selected slot 0 is left in its kzalloc()'ed state with ism_dev[0] == NULL and ism_chid[0] == 0. smc_v2_determine_accepted_chid() then matches the peer's CHID against the array starting from index 0 using the CHID alone. A malicious peer replying to a SMC-Dv2-only proposal with d1.chid == 0 matches the empty slot, ini->ism_selected becomes 0, and the subsequent ism_dev[0]->lgr_lock dereference in smc_conn_create() faults at offsetof(struct smcd_dev, lgr_lock) == 0x68: BUG: KASAN: null-ptr-deref in _raw_spin_lock_bh+0x79/0xe0 Write of size 4 at addr 0000000000000068 by task exploit/144 Call Trace: _raw_spin_lock_bh smc_conn_create (net/smc/smc_core.c:1997) __smc_connect (net/smc/af_smc.c:1447) smc_connect (net/smc/af_smc.c:1720) __sys_connect __x64_sys_connect do_syscall_64 Require ism_dev[i] to be non-NULL before accepting a CHID match.

CVSS: 7.5 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Oct 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from a7c9c5f4af7f6098da68705fc5d86565d0728ef7 before 903f7688ffeb9b323d70652c01f554bd4ba2a3d6; from a7c9c5f4af7f6098da68705fc5d86565d0728ef7 before dd2f9dd83c68abd7ba7ded7075290b016cb7ecd0; from a7c9c5f4af7f6098da68705fc5d86565d0728ef7 before 6927cacf2b10d4fa80c1a2d407512ef9397c59c6; from a7c9c5f4af7f6098da68705fc5d86565d0728ef7 before d38ba387244e5c5f7db3e11ea98bc2c7beccb0c0; from a7c9c5f4af7f6098da68705fc5d86565d0728ef7 before 53eb7bd09aace72fa17510d80e0caf5ca058c231; from a7c9c5f4af7f6098da68705fc5d86565d0728ef7 before afa9036b8c9963947b487c36e332df6a42c96fcb; from a7c9c5f4af7f6098da68705fc5d86565d0728ef7 before 65edb3b0822cfe5041be8fbabebd57e2e5ad9f4e; from a7c9c5f4af7f6098da68705fc5d86565d0728ef7 before 277740023def559a4a2ddc3e8e784ee37a0f16a9	CNA record
linux linux_kernel linux:linux_kernel	from 5.10 before 5.10.266; from 5.11 before 5.15.217; from 5.16 before 6.1.175; from 6.2 before 6.6.142; from 6.7 before 6.12.92; from 6.13 before 6.18.34; from 6.19 before 7.0.11; 7.1; and 2 more ranges	NVD

References

https://git.kernel.org/stable/c/903f7688ffeb9b323d70652c01f554bd4ba2a3d6patch
https://git.kernel.org/stable/c/dd2f9dd83c68abd7ba7ded7075290b016cb7ecd0patch
https://git.kernel.org/stable/c/6927cacf2b10d4fa80c1a2d407512ef9397c59c6patch
https://git.kernel.org/stable/c/d38ba387244e5c5f7db3e11ea98bc2c7beccb0c0patch
https://git.kernel.org/stable/c/53eb7bd09aace72fa17510d80e0caf5ca058c231patch
https://git.kernel.org/stable/c/afa9036b8c9963947b487c36e332df6a42c96fcbpatch
https://git.kernel.org/stable/c/65edb3b0822cfe5041be8fbabebd57e2e5ad9f4epatch
https://git.kernel.org/stable/c/277740023def559a4a2ddc3e8e784ee37a0f16a9patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.