CVE-2026-46027 net/smc: avoid early lgr access in smc_clc_wait_msg
A null pointer dereference in the Linux kernel SMC module allows remote attackers to cause a denial of service via early CLC decline messages.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-46027?
CVE-2026-46027 is a high-severity vulnerability in Linux kernel, published on 27 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net/smc: avoid early lgr access in smc_clc_wait_msg
A CLC decline can be received while the handshake is still in an early stage, before the connection has been associated with a link group.
The decline handling in smc_clc_wait_msg() updates link-group level sync state for first-contact declines, but that state only exists after link group setup has completed. Guard the link-group update accordingly and keep the per-socket peer diagnosis handling unchanged.
This preserves the existing sync_err handling for established link-group contexts and avoids touching link-group state before it is available.
Weakness: CWE-617
Which versions are affected by CVE-2026-46027?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-46027?
Apply the vendor's patch.
Is CVE-2026-46027 being exploited?
There is no known exploitation of CVE-2026-46027 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-88725, BELL-CVE-2026-46027, DEBIAN-CVE-2026-46027, GHSA-6hp6-98mx-37xj, ROOT-OS-DEBIAN-11-CVE-2026-46027, ROOT-OS-DEBIAN-12-CVE-2026-46027 and 3 more.