CVE-2026-74719: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-74719 is a kernel memory leak vulnerability in the Linux kernel's SMC (Shared Memory Communications) protocol handler, specifically in the smc_llc_event_handler() function. The flaw affects Linux kernel versions starting from 5.8 and was published on August 22, 2026. Fixed versions include 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, and 7.2+. The CVSS score has not been formally assigned yet, but Feedly estimates the severity as Medium (GitHub Advisory, Feedly).

The root cause is a missing guard check (CWE-401: Missing Release of Memory after Effective Lifetime) in the SMC_LLC_CONFIRM_LINK / SMC_LLC_ADD_LINK_CONT branch of smc_llc_event_handler(). When a qentry is already set in the local LLC flow (flow->qentry), a second incoming CONFIRM_LINK or ADD_LINK_CONT message causes smc_llc_flow_qentry_set() to overwrite the existing pointer without freeing the previous kmalloc-96 allocation, leaking one kernel heap object per spurious message. The sibling SMC_LLC_DELETE_LINK branch and the response path (smc_llc_rx_response()) already implement the correct !flow->qentry guard; the fix applies the same guard to the vulnerable branch so duplicate messages fall through to break and are freed by the kfree(qentry) at the out: label. Exploitation requires the ability to send crafted SMC LLC protocol messages to a target system (GitHub Advisory).

A remote attacker capable of sending specially crafted SMC protocol messages (specifically duplicate CONFIRM_LINK or ADD_LINK_CONT frames) can repeatedly trigger kernel memory leaks, with each spurious message leaking one kmalloc-96 object from the kernel heap. Over time, sustained exploitation can exhaust available kernel memory, degrading system performance or potentially causing a denial-of-service crash. Confidentiality and integrity are not directly impacted; the primary risk is availability (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). The EPSS score is reported as 0.0, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires network-level access to a system using the SMC protocol, limiting the attack surface to environments where SMC is actively deployed (typically high-performance Linux networking scenarios). No threat actor attribution has been reported.

• System Behavior: Gradual, unexplained increase in kernel memory consumption (/proc/meminfo showing declining MemFree/MemAvailable) on systems using SMC networking.
• Logs: Kernel OOM (Out-of-Memory) killer events in /var/log/kern.log or dmesg output, potentially preceded by memory pressure warnings.
• Network: Unusual volume of SMC LLC CONFIRM_LINK or ADD_LINK_CONT frames from a single peer, detectable via packet capture on RDMA/SMC-capable network interfaces.
• Process: Abnormal memory usage trends in kernel slab allocator statistics (/proc/slabinfo), specifically growth in kmalloc-96 entries without corresponding frees.

Apply the available kernel patches that add the !flow->qentry guard to the CONFIRM_LINK/ADD_LINK_CONT branch. Fixed versions are: 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, and 7.2+. As a temporary workaround, disable the SMC protocol if it is not actively required (e.g., via modprobe -r smc or blocking SMC traffic at the network perimeter), and restrict network access to systems running vulnerable kernel versions (GitHub Advisory, Feedly).