The Linux kernel vulnerability in net/smc involves the smc_msg_event tracepoint unconditionally dereferencing conn->lnk, which is NULL for SMC-D sockets. This leads to a NULL pointer dereference and a kernel crash when the tracepoint is enabled and the first sendmsg()/recvmsg() call is made on an SMC-D socket. The vulnerability is triggered by unprivileged users due to lack of capability checks on socket(AF_SMC, ...) and no admin requirements for SMC-D negotiation on s390 and x86 with loopback ISM device. The fix replaces the dereference with logging an empty device name for SMC-D to avoid the NULL dereference.

The vulnerability causes a denial of service via a kernel crash (general protection fault) when the smc_msg_event tracepoint is enabled and an SMC-D socket performs sendmsg() or recvmsg(). There is no confidentiality or integrity impact reported. The vulnerability can be triggered by unprivileged users, potentially allowing local denial of service on affected systems.

A fix is available that resolves the NULL pointer dereference by avoiding the dereference of conn->lnk when it is NULL and instead logging an empty device name for SMC-D. Systems running affected Linux kernel versions should be updated to a fixed version. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor advisory for current remediation guidance.