CVE-2026-52941: Linux kernel · net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in d2ea0b8aef8746e147602eac87ca8538f4bc7e66 : update Linux kernel when convenient.
Data as of 6 Nov 2026, 16:49 UTC
Rated by Threat Radar · No CVSS score from NVD or the CNA
Thin evidence
One scorer or none- CISA SSVC
- Exploitation
- No evidence of active exploitation and no public proof of concept
- Automatable
- Attackers cannot reliably automate steps 1–4 of the kill chain
- Technical impact
- Limited control over the software or limited information exposure
CISA SSVC assessment, 2026-11-06.
- Patch
- Available – fixed in d2ea0b8aef8746e147602eac87ca8538f4bc7e66, b706d6d76a2a2793fe5ad0fbc2a75b6a460094ef, 68200112534bb2acd1d7117dc2d5c124868d866d +3
Exploitation evidence
Disclosed: evidence found.
CVE published 24 Jun 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
Description
In the Linux kernel, the following vulnerability has been resolved: net/smc: avoid NULL deref of conn->lnk in smc_msg_event tracepoint The smc_msg_event tracepoint class, shared by smc_tx_sendmsg and smc_rx_recvmsg, unconditionally dereferences smc->conn.lnk: __string(name, smc->conn.lnk->ibname) conn->lnk is only set for SMC-R; for SMC-D it is NULL. Other code on these paths already handles this (e.g. !conn->lnk in SMC_STAT_RMB_TX_SIZE_SMALL()). With the tracepoint enabled, the first sendmsg()/recvmsg() on an SMC-D socket crashes: Oops: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [...] RIP: 0010:strlen+0x1e/0xa0 Call Trace: trace_event_raw_event_smc_msg_event (net/smc/smc_tracepoint.h:44) smc_rx_recvmsg (net/smc/smc_rx.c:515) smc_recvmsg (net/smc/af_smc.c:2859) __sys_recvfrom (net/socket.c:2315) __x64_sys_recvfrom (net/socket.c:2326) do_syscall_64 The faulting address 0x3e0 is offsetof(struct smc_link, ibname), confirming the NULL ->lnk deref. Enabling the tracepoint requires root, but the trigger itself is unprivileged: socket(AF_SMC, ...) has no capability check, and SMC-D negotiation needs no admin step on s390 or on x86 with the loopback ISM device loaded. Log an empty device name for SMC-D instead of dereferencing NULL.
References
- git.kernel.org/stable/c/68200112534bb2acd1d7117dc2d5c124868d866d (opens in a new tab)
- git.kernel.org/stable/c/720c76b930c52cd58f50eb6b10569d03dccc7959 (opens in a new tab)
- git.kernel.org/stable/c/b706d6d76a2a2793fe5ad0fbc2a75b6a460094ef (opens in a new tab)
- git.kernel.org/stable/c/d2ea0b8aef8746e147602eac87ca8538f4bc7e66 (opens in a new tab)
- git.kernel.org/stable/c/561cf66fa9b6c86dfe4e687d2d1aeaaa6739917f (opens in a new tab)
- git.kernel.org/stable/c/7bf563badd37cb796df5477d2b78bb64148a1268 (opens in a new tab)