In the Linux kernel, the following vulnerability has been resolved: net/smc: protect clcsock lifetime in smc_getname smc_getname() dereferences… (CVE-2026-99032)

The Linux kernel's net/smc subsystem had a vulnerability in smc_getname() where it dereferenced smc->clcsock without holding the clcsock_release_lock. This allowed a race condition during link-group termination, where the CLC socket could be released asynchronously by smc_close_active_abort() while the SMC socket was still open. A getsockname() syscall could load the pointer before it was cleared and released, causing a use-after-free or, if the pointer was cleared first, a NULL dereference. KASAN testing confirmed the use-after-free condition. The patch serializes access by holding clcsock_release_lock across the pointer check and callback, returning -EBADF if the socket was already released.

The vulnerability can cause kernel crashes or undefined behavior due to use-after-free or NULL pointer dereference in the SMC socket subsystem. This could potentially be exploited to cause denial of service or other kernel-level instability. However, no known exploits in the wild have been reported.

A fix is available that involves holding the clcsock_release_lock during smc_getname() to prevent asynchronous release of the CLC socket. Systems should apply the official kernel patch that addresses this race condition. Until patched, avoid relying on the affected SMC socket functionality in untrusted environments.