CVE-2024-26615

net/smc: fix illegal rmb_desc access in SMC-D connection dump

MEDIUM

5.5

CVSS Score

Published: February 29, 2024 at 03:52 PM UTC

Updated: June 17, 2026 at 07:17 AM UTC

1 product affected across 1 vendorLinux Kernel

Using Linux by Linux?

Get instant alerts when new vulnerabilities affect Linux - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM5.5

Exploit prediction

EPSS 0.3%

SSVC

No known exploit

Description

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix illegal rmb_desc access in SMC-D connection dump A crash was found when dumping SMC-D connections. It can be reproduced by following steps: - run nginx/wrk test: smc_run nginx smc_run wrk -t 16 -c 1000 -d <duration> -H 'Connection: Close' <URL> - continuously dump SMC-D connections in parallel: watch -n 1 'smcss -D' BUG: kernel NULL pointer dereference, address: 0000000000000030 CPU: 2 PID: 7204 Comm: smcss Kdump: loaded Tainted: G E 6.7.0+ #55 RIP: 0010:__smc_diag_dump.constprop.0+0x5e5/0x620 [smc_diag] Call Trace: <TASK> ? __die+0x24/0x70 ? page_fault_oops+0x66/0x150 ? exc_page_fault+0x69/0x140 ? asm_exc_page_fault+0x26/0x30 ? __smc_diag_dump.constprop.0+0x5e5/0x620 [smc_diag] ? __kmalloc_node_track_caller+0x35d/0x430 ? __alloc_skb+0x77/0x170 smc_diag_dump_proto+0xd0/0xf0 [smc_diag] smc_diag_dump+0x26/0x60 [smc_diag] netlink_dump+0x19f/0x320 __netlink_dump_start+0x1dc/0x300 smc_diag_handler_dump+0x6a/0x80 [smc_diag] ? __pfx_smc_diag_dump+0x10/0x10 [smc_diag] sock_diag_rcv_msg+0x121/0x140 ? __pfx_sock_diag_rcv_msg+0x10/0x10 netlink_rcv_skb+0x5a/0x110 sock_diag_rcv+0x28/0x40 netlink_unicast+0x22a/0x330 netlink_sendmsg+0x1f8/0x420 __sock_sendmsg+0xb0/0xc0 ____sys_sendmsg+0x24e/0x300 ? copy_msghdr_from_user+0x62/0x80 ___sys_sendmsg+0x7c/0xd0 ? __do_fault+0x34/0x160 ? do_read_fault+0x5f/0x100 ? do_fault+0xb0/0x110 ? __handle_mm_fault+0x2b0/0x6c0 __sys_sendmsg+0x4d/0x80 do_syscall_64+0x69/0x180 entry_SYSCALL_64_after_hwframe+0x6e/0x76 It is possible that the connection is in process of being established when we dump it. Assumed that the connection has been registered in a link group by smc_conn_create() but the rmb_desc has not yet been initialized by smc_buf_create(), thus causing the illegal access to conn->rmb_desc. So fix it by checking before dump.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Linux Kernel · Linux

95%

4.19 ≤ v < 4.19.3074.19 ≤ v < 5.10.2104.19 ≤ v < 5.15.1494.19 ≤ v < 5.4.2694.19 ≤ v < 6.1.764.19 ≤ v < 6.6.154.19 ≤ v < 6.7.34.19 ≤ v < 6.84.20 ≤ v < 5.4.2695.11 ≤ v < 5.15.1495.16 ≤ v < 6.1.765.5 ≤ v < 5.10.2106.2 ≤ v < 6.6.156.7 ≤ v < 6.7.34b1b7d3b30a6d32ac1a1dcede284e76ef8a8542d6.8 rc1

Vendor states this is fixed in 1fea9969b81c67d0cb1611d1b8b7d19049d937be (fixed)

Vendor states this is fixed in 27aea64838914c6122db5b8bd4bed865c9736f22 (fixed)

Vendor states this is fixed in 5fed92ca32eafbfae8b6bee8ca34cca71c6a8b6d (fixed)

Vendor states this is fixed in 68b888d51ac82f2b96bf5e077a31d76afcdef25a (fixed)

Vendor states this is fixed in 6994dba06321e3c48fdad0ba796a063d9d82183a (fixed)

Vendor states this is fixed in 8f3f9186e5bb96a9c9654c41653210e3ea7e48a6 (fixed)

Vendor states this is fixed in a164c2922675d7051805cdaf2b07daffe44f20d9 (fixed)

Vendor states this is fixed in dbc153fd3c142909e564bb256da087e13fbf239c (fixed)

Vendor states this is fixed in 4.19 (unaffected)

Vendor states this is fixed in 4.19.307 (unaffected)

Vendor states this is fixed in 5.10.210 (unaffected)

Vendor states this is fixed in 5.15.149 (unaffected)