CVE-2026-98559

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98559", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.357Z", "datePublished": "2026-10-18T15:18:26.349Z", "dateUpdated": "2026-10-19T09:21:43.436Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:21:43.436Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix UAF on lgr list traversal in smcr_port_err()\n\nsmcr_port_err() traverses smc_lgr_list.list without holding\nsmc_lgr_list.lock, allowing a concurrent smc_lgr_terminate_sched()\nto free an lgr while it is still being dereferenced.\n\nHold smc_lgr_list.lock across the traversal. Update\nsmc_ib_gid_check() to call smcr_port_err() after releasing the lock."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/smc/smc_core.c", "net/smc/smc_ib.c"], "versions": [{"version": "541afa10c126b6c22c2a805a559c70cc41fd156e", "lessThan": "34bcf11cd2528ae00bb6d764d808083c66824277", "status": "affected", "versionType": "git"}, {"version": "541afa10c126b6c22c2a805a559c70cc41fd156e", "lessThan": "0edcc4284392b28826b5d37532b366b291e6e0fa", "status": "affected", "versionType": "git"}, {"version": "541afa10c126b6c22c2a805a559c70cc41fd156e", "lessThan": "00a59600ae72d24859d0ad1783a78bc921bc2599", "status": "affected", "versionType": "git"}, {"version": "541afa10c126b6c22c2a805a559c70cc41fd156e", "lessThan": "3d35f069e1c119992000d51236dbe54da2d4e61e", "status": "affected", "versionType": "git"}, {"version": "541afa10c126b6c22c2a805a559c70cc41fd156e", "lessThan": "3d65a2eb4449fc9658fb860dea893025d028d90e", "status": "affected", "versionType": "git"}, {"version": "541afa10c126b6c22c2a805a559c70cc41fd156e", "lessThan": "a9b968e42690d784c241a0761c10253271f7df5d", "status": "affected", "versionType": "git"}, {"version": "541afa10c126b6c22c2a805a559c70cc41fd156e", "lessThan": "61cb282fe97b3b0ba32ca09417a693162bf4ae3f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/smc/smc_core.c", "net/smc/smc_ib.c"], "versions": [{"version": "5.8", "status": "affected"}, {"version": "0", "lessThan": "5.8", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.8", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/34bcf11cd2528ae00bb6d764d808083c66824277"}, {"url": "https://git.kernel.org/stable/c/0edcc4284392b28826b5d37532b366b291e6e0fa"}, {"url": "https://git.kernel.org/stable/c/00a59600ae72d24859d0ad1783a78bc921bc2599"}, {"url": "https://git.kernel.org/stable/c/3d35f069e1c119992000d51236dbe54da2d4e61e"}, {"url": "https://git.kernel.org/stable/c/3d65a2eb4449fc9658fb860dea893025d028d90e"}, {"url": "https://git.kernel.org/stable/c/a9b968e42690d784c241a0761c10253271f7df5d"}, {"url": "https://git.kernel.org/stable/c/61cb282fe97b3b0ba32ca09417a693162bf4ae3f"}], "title": "net/smc: fix UAF on lgr list traversal in smcr_port_err()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/smc/smc_core.c", "net/smc/smc_ib.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "34bcf11cd2528ae00bb6d764d808083c66824277", "status": "affected", "version": "541afa10c126b6c22c2a805a559c70cc41fd156e", "versionType": "git"}, {"lessThan": "0edcc4284392b28826b5d37532b366b291e6e0fa", "status": "affected", "version": "541afa10c126b6c22c2a805a559c70cc41fd156e", "versionType": "git"}, {"lessThan": "00a59600ae72d24859d0ad1783a78bc921bc2599", "status": "affected", "version": "541afa10c126b6c22c2a805a559c70cc41fd156e", "versionType": "git"}, {"lessThan": "3d35f069e1c119992000d51236dbe54da2d4e61e", "status": "affected", "version": "541afa10c126b6c22c2a805a559c70cc41fd156e", "versionType": "git"}, {"lessThan": "3d65a2eb4449fc9658fb860dea893025d028d90e", "status": "affected", "version": "541afa10c126b6c22c2a805a559c70cc41fd156e", "versionType": "git"}, {"lessThan": "a9b968e42690d784c241a0761c10253271f7df5d", "status": "affected", "version": "541afa10c126b6c22c2a805a559c70cc41fd156e", "versionType": "git"}, {"lessThan": "61cb282fe97b3b0ba32ca09417a693162bf4ae3f", "status": "affected", "version": "541afa10c126b6c22c2a805a559c70cc41fd156e", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/smc/smc_core.c", "net/smc/smc_ib.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.8"}, {"lessThan": "5.8", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix UAF on lgr list traversal in smcr_port_err()\n\nsmcr_port_err() traverses smc_lgr_list.list without holding\nsmc_lgr_list.lock, allowing a concurrent smc_lgr_terminate_sched()\nto free an lgr while it is still being dereferenced.\n\nHold smc_lgr_list.lock across the traversal. Update\nsmc_ib_gid_check() to call smcr_port_err() after releasing the lock."}], "id": "CVE-2026-98559", "lastModified": "2026-10-19T10:19:12.447", "metrics": {}, "published": "2026-10-18T16:17:08.033", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/00a59600ae72d24859d0ad1783a78bc921bc2599"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0edcc4284392b28826b5d37532b366b291e6e0fa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/34bcf11cd2528ae00bb6d764d808083c66824277"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3d35f069e1c119992000d51236dbe54da2d4e61e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3d65a2eb4449fc9658fb860dea893025d028d90e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/61cb282fe97b3b0ba32ca09417a693162bf4ae3f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a9b968e42690d784c241a0761c10253271f7df5d"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net/smc: fix UAF on lgr list traversal in smcr_port_err()", "id": "2555033", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555033"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet/smc: fix UAF on lgr list traversal in smcr_port_err()\nsmcr_port_err() traverses smc_lgr_list.list without holding\nsmc_lgr_list.lock, allowing a concurrent smc_lgr_terminate_sched()\nto free an lgr while it is still being dereferenced.\nHold smc_lgr_list.lock across the traversal. Update\nsmc_ib_gid_check() to call smcr_port_err() after releasing the lock.", "A flaw was found in the Linux kernel's Shared Memory Communications (SMC) subsystem. When processing port errors, the kernel traverses active link groups without holding the appropriate lock, allowing a concurrent termination event to free memory while it is still in use. An attacker capable of inducing these concurrent network events could exploit this race condition to trigger a use-after-free flaw, leading to a Denial of Service (DoS) via a system crash."], "name": "CVE-2026-98559", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98559\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98559\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98559.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[541afa10c126b6c22c2a805a559c70cc41fd156e,34bcf11cd2528ae00bb6d764d808083c66824277)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[541afa10c126b6c22c2a805a559c70cc41fd156e,0edcc4284392b28826b5d37532b366b291e6e0fa)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[541afa10c126b6c22c2a805a559c70cc41fd156e,00a59600ae72d24859d0ad1783a78bc921bc2599)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[541afa10c126b6c22c2a805a559c70cc41fd156e,3d35f069e1c119992000d51236dbe54da2d4e61e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[541afa10c126b6c22c2a805a559c70cc41fd156e,3d65a2eb4449fc9658fb860dea893025d028d90e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[541afa10c126b6c22c2a805a559c70cc41fd156e,a9b968e42690d784c241a0761c10253271f7df5d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[541afa10c126b6c22c2a805a559c70cc41fd156e,61cb282fe97b3b0ba32ca09417a693162bf4ae3f)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.8"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.8)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.222,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.189,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.158,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.112,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.55,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.9,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc5,*)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T23:15:14.331307+00:00", "updated": "2026-10-22T22:30:13.431107+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}