CVE-2026-98559 net/smc: fix UAF on lgr list traversal in smcr_port_err()
A use-after-free vulnerability in the Linux kernel's SMC protocol allows attackers to cause denial of service or execute arbitrary code via concurrent list traversal.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98559?
CVE-2026-98559 is an use after free vulnerability in Linux, published on 18 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net/smc: fix UAF on lgr list traversal in smcr_port_err()
smcr_port_err() traverses smc_lgr_list.list without holding smc_lgr_list.lock, allowing a concurrent smc_lgr_terminate_sched() to free an lgr while it is still being dereferenced.
Hold smc_lgr_list.lock across the traversal. Update smc_ib_gid_check() to call smcr_port_err() after releasing the lock.
Which versions are affected by CVE-2026-98559?
How do I fix CVE-2026-98559?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-98559 being exploited?
There is no known exploitation of CVE-2026-98559 in the wild and no public exploit code.
Sources
Also known as AZL-109433, BELL-CVE-2026-98559, DEBIAN-CVE-2026-98559, GHSA-4x5q-83g5-68jv, UBUNTU-CVE-2026-98559.