{"id":"AZL-100202","summary":"CVE-2026-80982 affecting package kernel 6.6.150.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix use-after-free in smc_rx_pipe_buf_release()\n\nsmc_rx_splice() hands RMB pages to a pipe and takes a socket reference\nper entry so the smc_sock stays alive until the reader finishes. The\nconnection does not: a concurrent close runs smc_conn_free(), which\nreleases the receive buffer back to the link group pool.\n\nsmc_rx_pipe_buf_release() tests sk_state before taking the socket lock.\nThe state can change between the test and the lock, and\nsmc_rx_update_cons() then dereferences conn-\u003ermb_desc and walks\nconn-\u003elgr, which smc_conn_free() has already released. On the\nis_reg_err path smcr_buf_unuse() frees the descriptor outright, so\nthis is a use-after-free.\n\nTake the socket lock first and test conn-\u003efreed instead.\nsmc_conn_free() sets that flag before releasing anything, and every\ncaller holds the socket lock. The two paths exclude each other: either\nthe pipe release runs first with everything valid, or it sees the flag\nand skips the update.","modified":"2026-09-12T14:15:14.562440831Z","published":"2026-09-11T20:19:04Z","upstream":["CVE-2026-80982"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80982"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.150.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-100202.json"}}],"schema_version":"1.9.0"}