The vulnerability in the Linux kernel involves the net/smc subsystem where smc_close_stream_wait() calls smc_tx_prepared_sends() inside a sk_wait_event() condition that is evaluated once with the socket lock released. Meanwhile, smcd_buf_detach() clears the send buffer descriptor (conn->sndbuf_desc) under lock_sock() in smc_conn_kill(). This race condition can cause the helper function to dereference a NULL pointer during socket closure, resulting in a fault. The fix involves sampling the send buffer pointer once and reporting no prepared sends if it is unset, also bounding the ioctl accordingly. The receive tasklet dereferences the field directly but is not affected due to timing constraints.

The vulnerability can cause a NULL pointer dereference leading to a fault during socket closure in the SMC-D subsystem of the Linux kernel. This could result in a denial of service by crashing the affected process or kernel thread handling the socket close operation. There is no indication of code execution or privilege escalation from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The description indicates the vulnerability has been resolved, implying a fix is available. Users should apply the official Linux kernel updates that address this issue once released.