CVE-2026-64048 net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
A malicious peer can trigger a null pointer dereference in the Linux kernel SMC-D module, causing a system crash.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64048?
CVE-2026-64048 is a high-severity vulnerability in Linux kernel, published on 19 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot
On the SMC-D client, slot 0 of ini->ism_dev[]/ini->ism_chid[] is reserved for an SMC-Dv1 device. smc_find_ism_v2_device_clnt() populates V2 entries starting at index 1, so when no V1 device is selected slot 0 is left in its kzalloc()'ed state with ism_dev[0] == NULL and ism_chid[0] == 0.
smc_v2_determine_accepted_chid() then matches the peer's CHID against the array starting from index 0 using the CHID alone. A malicious peer replying to a SMC-Dv2-only proposal with d1.chid == 0 matches the empty slot, ini->ism_selected becomes 0, and the subsequent ism_dev[0]->lgr_lock dereference in smc_conn_create() faults at offsetof(struct smcd_dev, lgr_lock) == 0x68:
BUG: KASAN: null-ptr-deref in _raw_spin_lock_bh+0x79/0xe0 Write of size 4 at addr 0000000000000068 by task exploit/144 Call Trace: _raw_spin_lock_bh smc_conn_create (net/smc/smc_core.c:1997) __smc_connect (net/smc/af_smc.c:1447) smc_connect (net/smc/af_smc.c:1720) __sys_connect __x64_sys_connect do_syscall_64
Require ism_dev[i] to be non-NULL before accepting a CHID match.
Weakness: CWE-476
Which versions are affected by CVE-2026-64048?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64048?
Apply the vendor's patch.
Is CVE-2026-64048 being exploited?
There is no known exploitation of CVE-2026-64048 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-64048, DEBIAN-CVE-2026-64048, GHSA-942p-vjp4-xm8p, ROOT-OS-DEBIAN-11-CVE-2026-64048, ROOT-OS-UBUNTU-2204-CVE-2026-64048, UBUNTU-CVE-2026-64048.