The vulnerability in the Linux kernel's net/smc subsystem was due to smc_conn_free() not setting the connection as killed while the link group was still on the device list, and smc_lgr_terminate_sched() unlinking the group immediately but deferring connection killing. This allowed a connection freed during this window to keep its smcd->conn[] slot with both gates open in smcd_handle_irq(), enabling the device to re-arm the receive tasklet after tasklet_kill() returned. On the DMB-nocopy path, this led to dereferencing a freed ghost send buffer. The fix involved unregistering connections unconditionally and draining tasklets before detach at both teardown sites, and clearing sndbuf_desc pointers before freeing to prevent readers from accessing freed memory.

This vulnerability could lead to use-after-free conditions in the kernel networking code, potentially causing kernel crashes or undefined behavior. No known exploits in the wild have been reported. The impact is limited to the Linux kernel's SMC networking subsystem and requires conditions involving connection teardown and tasklet handling.

A fix has been applied in the Linux kernel to address this issue by properly unregistering connections and draining tasklets before teardown. Users should update to a kernel version that includes this fix once available. Patch status is not yet confirmed in the provided data; check the official Linux kernel advisories or vendor updates for current remediation guidance.