CVE-2026-23450: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23450 is a race condition vulnerability in the Linux kernel's SMC (Shared Memory Communications) subsystem that causes NULL pointer dereference and use-after-free (UAF) in smc_tcp_syn_recv_sock(). It was discovered via Syzkaller fuzzing and published on April 3, 2026. Affected kernel versions include 5.15.174–5.15.203, 5.18–6.1.167, 6.2–6.6.130, 6.7–6.12.78, 6.13–6.18.20, 6.19–6.19.10, and pre-release 7.0-rc1 through rc5. It carries a CVSS v3.1 base score of 9.8 (Critical) (Github Advisory).

The root cause is a race condition (CWE-416: Use After Free) between the TCP receive path (softirq context) and the SMC socket closure path (process context). smc_tcp_syn_recv_sock() reads sk_user_data to obtain the smc_sock pointer; concurrently, smc_close_active() sets clcsock->sk_user_data to NULL under sk_callback_lock, and the smc_sock is freed via sock_put() in smc_release(). This creates two exploitable conditions: (1) a NULL pointer dereference if sk_user_data is read as NULL, and (2) a UAF if sk_user_data is read as non-NULL but the smc_sock is freed before fields such as queued_smc_hs or ori_af_ops are accessed. The race is triggerable via both the SYN cookie path (tcp_get_cookie_sock()) and the normal tcp_check_req() path, and can be initiated remotely by sending crafted SYN packets to an SMC listening socket while it is being closed (Github Advisory).

Successful exploitation can cause kernel panics (denial of service) on affected Linux systems, with the CVSS score reflecting high impact across confidentiality, integrity, and availability. A remote, unauthenticated attacker can trigger the vulnerability by sending crafted SYN packets to an SMC-enabled listening socket during concurrent socket closure, potentially crashing the host kernel. In a worst-case scenario, the UAF condition could be leveraged for memory corruption beyond a simple crash, though no privilege escalation or code execution has been demonstrated publicly (Github Advisory).

1. Reconnaissance: Identify Linux hosts running affected kernel versions (5.15.174–5.15.203, 5.18–6.1.167, 6.2–6.6.130, 6.7–6.12.78, 6.13–6.18.20, 6.19–6.19.10, or 7.0-rc1–rc5) with SMC over TCP enabled and listening sockets exposed to the network.
2. Trigger socket closure: Arrange or wait for an SMC listening socket to enter the closure path (e.g., by causing the server application to restart or close its socket), initiating smc_close_active() on CPU B.
3. Race the SYN path: Simultaneously flood the target with TCP SYN packets (SYN flood) directed at the SMC listening port, causing the kernel to process SYN packets via tcp_v4_rcv() → smc_tcp_syn_recv_sock() on CPU A (softirq).
4. Exploit the race window: The SYN processing reads sk_user_data after it has been set to NULL (or after smc_sock has been freed), triggering either a NULL pointer dereference or a UAF when accessing smc->queued_smc_hs or smc->ori_af_ops.
5. Achieve denial of service: The kernel panics, crashing the affected host. Advanced exploitation of the UAF for memory corruption or privilege escalation has not been publicly demonstrated (Github Advisory).

• Logs: Kernel panic messages in /var/log/kern.log or dmesg referencing smc_tcp_syn_recv_sock, NULL pointer dereference, or use-after-free in the SMC/TCP subsystem.
• Logs: Syzkaller-style crash reports or BUG/KASAN output mentioning smc_close_active, smc_release, or sk_user_data.
• Network: Anomalous SYN flood traffic targeting ports associated with SMC listening sockets, particularly timed with application restarts or socket closure events.
• Process: Unexpected kernel oops or system reboots on hosts running SMC-enabled workloads, especially under high connection load.

Apply the upstream kernel patches available via the Linux stable tree for all affected version branches (fixed in 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, and 6.19.10). The fix implements RCU protection: SOCK_RCU_FREE is set on SMC listen sockets to defer smc_sock freeing until after the RCU grace period, rcu_read_lock() protects sk_user_data reads, and refcount_inc_not_zero() safely pins the smc_sock with bailout if the refcount has reached zero. As a temporary workaround where patching is not immediately feasible, consider disabling the SMC protocol on affected systems or applying network-level SYN flood protections (e.g., SYN cookies, rate limiting) to reduce the attack surface. SUSE has also released security updates (SUSE-SU-202621834-1, SUSE-SU-20262195-1, SUSE-SU-20262215-1, SUSE-SU-20262238-1) for affected SUSE/openSUSE distributions (Github Advisory, SUSE Advisory).

The vulnerability was reported to the Linux kernel security team via Syzkaller automated fuzzing and disclosed through the standard kernel CVE process on April 3, 2026. SUSE issued multiple security advisories addressing the flaw across their product lines. The Yocto Project security mailing list also tracked the issue for embedded Linux distributions. No notable independent researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking.