CVE-2026-80979

High

In the Linux kernel, the following vulnerability has been resolved: net/smc: unregister the connection before draining the rx tasklet smc_conn_free() calls smc_ism_unset_conn() only while the link group is still on its device list, and never sets conn->killed. smc_lgr_terminate_sched() unlinks the group immediately and defers killing its connections to a work item, so a connection freed in that window keeps its smcd->conn[] slot with both gates in smcd_handle_irq() open, and the device can re-arm the receive tasklet after tasklet_kill() has returned. On the DMB-nocopy path the ghost send buffer is freed right after that drain, so the re-armed tasklet dereferences it. Unregister unconditionally and drain before the detach at both teardown sites, mirroring rmb_desc, which smc_buf_unuse() releases after the drain. Clear conn->sndbuf_desc before freeing it as well, so a reader that samples the pointer cannot get one that is already freed.

Package Linux Kernel
Published 2026-09-11
Last modified 2026-09-14
CVSS version 3.1
Patch available
Yes

CVSS 3.1 score

7.8

out of 10
High
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected versions

Linux kernel versions 6.6.66, 6.10 and later are affected. Fixed in 6.6.157, 6.12.109, 6.18.50, 7.2.4, 7.3-rc1 and their respective stable series.

Affected from
≥ 6.6.66 ≥ 6.10
Fixed in
✓ 6.6.157 6.6.x ✓ 6.12.109 6.12.x ✓ 6.18.50 6.18.x ✓ 7.2.4 7.2.x ✓ 7.3-rc1

References

5 total

Frequently asked questions

  • What is CVE-2026-80979?

    CVE-2026-80979 is a High severity Linux kernel vulnerability with a CVSS score of 7.8 out of 10 . It affects Linux kernel versions from 6.6.66 onward and has been patched in 6.6.157, 6.12.109, 6.18.50 and others. CVE-2026-80979 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.

  • What is the CVSS score for CVE-2026-80979?

    CVE-2026-80979 has a CVSS score of 7.8 out of 10, rated High severity (CVSS 3.1). The vector string is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H .

  • Is there a patch available for CVE-2026-80979?

    Yes. CVE-2026-80979 has been patched. Fixed versions include 6.6.157, 6.12.109, 6.18.50 and others. If you are running Linux kernel 6.6.66 or later up to the fix versions, apply the relevant patch for your kernel branch.

  • Is CVE-2026-80979 actively exploited?

    No. CVE-2026-80979 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

Back to
All CVEs
View on
NVD / NIST