The vulnerability in the Linux kernel's SMC network code arises from improper reference counting in the smc_rx_splice() function. Specifically, pages are passed to splice_to_pipe() before taking the necessary references that cover the lifetime of each splice entry. In the VM-backed RMB path, splice_to_pipe() may drop unqueued entries prematurely, while queued entries are released later via pipe buffer callbacks. The previous accounting method derived the number of queued VM pages from a mutated offset and paired one sock_hold() with multiple sock_put() calls, causing a reference count imbalance. The fix involves taking page and socket references for every candidate entry before splice_to_pipe() and adjusting the release logic to prevent underflow of page reference counts and eliminate use-after-free risks.

This vulnerability can cause a use-after-free condition in the Linux kernel's SMC network subsystem, potentially leading to memory corruption or kernel instability. However, no known exploits in the wild have been reported. The impact is limited to systems using the affected SMC code path.

A fix has been implemented in the Linux kernel to correct the reference counting imbalance in smc_rx_splice(). Users should apply the official kernel updates that include this fix. Since no patch links or vendor advisories are provided here, check the Linux kernel mailing lists or official kernel repositories for the relevant patch and update instructions. Patch status is not yet confirmed in this data — verify with vendor sources for current remediation guidance.