{"id":21312,"date":"2026-09-12T04:31:01","date_gmt":"2026-09-11T20:31:01","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-80979"},"modified":"2026-09-12T04:31:01","modified_gmt":"2026-09-11T20:31:01","slug":"cve-2026-80979","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-80979","title":{"rendered":"CVE-2026-80979 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nnet\/smc: unregister t"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net\/smc: unregister the connection before draining the rx tasklet<\/p>\n<p>smc_conn_free() calls smc_ism_unset_conn() only while the link group is<br \/>\nstill on its device list, and never sets conn-&gt;killed.<br \/>\nsmc_lgr_terminate_sched() unlinks the group immediately and defers killing<br \/>\nits connections to a work item, so a connection freed in that window keeps<br \/>\nits smcd-&gt;conn[] slot with both gates in smcd_handle_irq() open, and the<br \/>\ndevice can re-arm the receive tasklet after tasklet_kill() has returned. On<br \/>\nthe DMB-nocopy path the ghost send buffer is freed right after that drain,<br \/>\nso the re-armed tasklet dereferences it.<\/p>\n<p>Unregister unconditionally and drain before the detach at both teardown<br \/>\nsites, mirroring rmb_desc, which smc_buf_unuse() releases after the drain.<br \/>\nClear conn-&gt;sndbuf_desc before freeing it as well, so a reader that samples<br \/>\nthe pointer cannot get one that is already freed.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>net\/smc: unregister the connection before draining the rx tasklet<\/p>\n<p>smc_conn_free() calls smc_ism_unset_conn() only while the link g<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21312","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21312","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21312"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21312"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21312"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}