In the Linux kernel, the following vulnerability has been resolved: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot On the SMC-D… (CVE-2026-64048)
In the Linux kernel, the following vulnerability has been resolved: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot On the SMC-D client, slot 0 of ini->ism_dev[]/ini->ism_chid[] is reserved for an SMC-Dv1 device. smc_find_ism_v2_device_clnt() populates V2 entries starting at index 1, so when no V1 device is selected slot 0 is left in its kzalloc()'ed state with ism_dev[0] == NULL and ism_chid[0] == 0. smc_v2_determine_accepted_chid() then matches the peer's CHID against the array starting from index 0 using the CHID alone. A malicious peer replying to a SMC-Dv2-only proposal with d1.chid == 0 matches the empty slot, ini->ism_selected becomes 0, and the subsequent ism_dev[0]->lgr_lock dereference in smc_conn_create() faults at offsetof(struct smcd_dev, lgr_lock) == 0x68: BUG: KASAN: null-ptr-deref in _raw_spin_lock_bh+0x79/0xe0 Write of size 4 at addr 0000000000000068 by task exploit/144 Call Trace: _raw_spin_lock_bh smc_conn_create (net/smc/smc_core.c:1997) __smc_connect (net/smc/af_smc.c:1447) smc_connect (net/smc/af_smc.c:1720) __sys_connect __x64_sys_connect do_syscall_64 Require ism_dev[i] to be non-NULL before accepting a CHID match.
AI Analysis
Technical Summary
The Linux kernel vulnerability CVE-2026-64048 involves the net/smc subsystem where the function smc_v2_determine_accepted_chid() matches a peer's CHID against an array starting at index 0. Slot 0 is reserved for SMC-Dv1 devices and may be NULL if no such device is selected. A malicious peer sending a CHID of 0 can cause the kernel to accept this match, leading to a NULL pointer dereference when smc_conn_create() attempts to access ism_dev[0]->lgr_lock. The fix requires verifying that ism_dev[i] is non-NULL before accepting a CHID match, preventing the NULL dereference.
Potential Impact
Successful exploitation causes a kernel NULL pointer dereference, resulting in a kernel crash (BUG) and denial of service. There is no indication of privilege escalation or arbitrary code execution from the provided data.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to require ism_dev[i] to be non-NULL before accepting a CHID match, preventing the NULL pointer dereference. Users should apply the official kernel update that includes this patch. Patch status is not explicitly confirmed in the provided data; check the vendor advisory or Linux kernel mailing lists for the official fix and update guidance.
In the Linux kernel, the following vulnerability has been resolved: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot On the SMC-D… (CVE-2026-64048)
Description
In the Linux kernel, the following vulnerability has been resolved: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot On the SMC-D client, slot 0 of ini->ism_dev[]/ini->ism_chid[] is reserved for an SMC-Dv1 device. smc_find_ism_v2_device_clnt() populates V2 entries starting at index 1, so when no V1 device is selected slot 0 is left in its kzalloc()'ed state with ism_dev[0] == NULL and ism_chid[0] == 0. smc_v2_determine_accepted_chid() then matches the peer's CHID against the array starting from index 0 using the CHID alone. A malicious peer replying to a SMC-Dv2-only proposal with d1.chid == 0 matches the empty slot, ini->ism_selected becomes 0, and the subsequent ism_dev[0]->lgr_lock dereference in smc_conn_create() faults at offsetof(struct smcd_dev, lgr_lock) == 0x68: BUG: KASAN: null-ptr-deref in _raw_spin_lock_bh+0x79/0xe0 Write of size 4 at addr 0000000000000068 by task exploit/144 Call Trace: _raw_spin_lock_bh smc_conn_create (net/smc/smc_core.c:1997) __smc_connect (net/smc/af_smc.c:1447) smc_connect (net/smc/af_smc.c:1720) __sys_connect __x64_sys_connect do_syscall_64 Require ism_dev[i] to be non-NULL before accepting a CHID match.
CVSS v3.1
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel vulnerability CVE-2026-64048 involves the net/smc subsystem where the function smc_v2_determine_accepted_chid() matches a peer's CHID against an array starting at index 0. Slot 0 is reserved for SMC-Dv1 devices and may be NULL if no such device is selected. A malicious peer sending a CHID of 0 can cause the kernel to accept this match, leading to a NULL pointer dereference when smc_conn_create() attempts to access ism_dev[0]->lgr_lock. The fix requires verifying that ism_dev[i] is non-NULL before accepting a CHID match, preventing the NULL dereference.
Potential Impact
Successful exploitation causes a kernel NULL pointer dereference, resulting in a kernel crash (BUG) and denial of service. There is no indication of privilege escalation or arbitrary code execution from the provided data.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to require ism_dev[i] to be non-NULL before accepting a CHID match, preventing the NULL pointer dereference. Users should apply the official kernel update that includes this patch. Patch status is not explicitly confirmed in the provided data; check the vendor advisory or Linux kernel mailing lists for the official fix and update guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-942p-vjp4-xm8p
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64048"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a5d27a92a4a8d598912cbd6
Added to database: 07/19/2026, 19:38:17 UTC
Last enriched: 07/19/2026, 19:55:50 UTC
Last updated: 07/20/2026, 19:41:22 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.