The Linux kernel's smc_switch_conns() function in the net/smc subsystem improperly handles socket reference counts during error conditions. Specifically, when smc_cdc_get_free_slot() fails during link failover or connection kill events, an early exit path returns without calling sock_put(), causing a socket reference count leak. This leak prevents the smc_sock from being destroyed, leaving send and receive buffers allocated and holding references on the network namespace, which blocks its teardown. The fix restructures the function to have a single sock_put() call that covers all exit paths, eliminating the leak.

The leaked socket reference count causes the smc_sock object to persist indefinitely, leading to resource leaks including allocated send and receive buffers. For user sockets, the network namespace reference is also retained, preventing the network namespace from being properly torn down. This can result in resource exhaustion and potential denial of service conditions related to network namespace lifecycle management. The vulnerability is triggered by hardware events causing link failover, which are normal operational conditions for the affected subsystem.

A code fix has been implemented in the Linux kernel to restructure smc_switch_conns() so that socket references are properly released on all error paths. Users should apply the official kernel update that includes this fix. Since this is a kernel-level issue, upgrading to a patched kernel version is the recommended remediation. No alternative mitigations are indicated.