CVE-2026-52941: Linux Kernel SMC Null Pointer Dereference DoS Vulnerability

Technical summary

The smc_msg_event tracepoint in net/smc unconditionally dereferences conn->lnk to read the ibname field without checking whether the link structure is allocated. SMC-R (RDMA) connections initialize conn->lnk during setup; SMC-D (DAPL) connections leave it NULL. When the tracepoint is active and an SMC-D socket calls sendmsg() or recvmsg(), the trace handler attempts to read strlen() on an invalid memory address corresponding to the uninitialized ibname pointer within a null smc_link structure. The crash occurs in trace_event_raw_event_smc_msg_event as it processes the __string() macro. The CWE-476 classification (Null Pointer Dereference) accurately describes the root cause.

Business impact

Kernel panics triggered by unprivileged users create a denial-of-service vector. Although an administrator must first enable tracing (a root-level operation), the actual crash trigger requires no privileges—any user can create an SMC-D socket and perform basic send/receive operations. On systems where SMC-D is available (native s390, or x86 with loopback ISM device), availability can be degraded. For kernel debugging and observability workflows that keep tracepoints enabled in production, this becomes a practical risk.

Affected systems

All Linux kernel versions with the SMC networking subsystem and the smc_msg_event tracepoint are affected. The vulnerability applies across architectures where SMC-D is available: s390, and x86 systems with ISM device support (particularly loopback ISM). Kernel versions prior to the fix commit are vulnerable; verify the exact affected range against the upstream Linux kernel security advisory.

Exploitability

Exploitability is straightforward: no special capabilities are required to open an SMC socket, negotiate an SMC-D connection, and call sendmsg() or recvmsg(). The barrier to exploitation is the prerequisite that tracing must already be enabled by a root user. On systems actively using dynamic tracing for performance monitoring or debugging, an unprivileged local user can trivially cause a kernel panic. The crash is deterministic and occurs on the first message operation after tracepoint activation.

Remediation

The fix modifies the tracepoint handler to log an empty string for the device name when conn->lnk is NULL (SMC-D case), rather than dereferencing a null pointer. This preserves tracing functionality for both SMC-R and SMC-D while preventing the crash. Apply the upstream kernel patch that resolves the null dereference in net/smc/smc_tracepoint.h.

Patch guidance

Upgrade to a patched Linux kernel version that includes the fix for CVE-2026-52941. Verify against the upstream Linux kernel advisory or your distribution's security updates for the exact version numbers. If you maintain custom kernel builds or use a specific distribution (RHEL, Ubuntu, Debian, SUSE, etc.), check with your vendor's advisory for the patched kernel release. For interim mitigation, disable the smc_msg_event tracepoint in production environments unless actively debugging SMC issues.

Detection guidance

Monitor kernel logs and crash dumps for null pointer dereferences in trace_event_raw_event_smc_msg_event or smc_msg_event tracepoint code. A system with active SMC-D traffic and enabled tracing that suddenly produces a 'general protection fault' with RIP in strlen() or the smc_tracepoint.h region indicates exploitation or triggering of this defect. Check /proc/sys/kernel/ftrace_enabled and examine which tracepoints are active using 'cat /sys/kernel/debug/tracing/enabled_events' to confirm the smc_msg_event tracepoint state.

Why prioritize this

Although the CVSS 3.1 score of 5.5 (Medium) reflects limited scope—local access only, no credential escalation—the practical impact is significant for kernel availability. Systems with active tracing (development, staging, or observability-focused production environments) face a reliable denial-of-service trigger. Organizations deploying SMC-D networking on s390 or x86 ISM systems should prioritize patching to maintain stability, especially if dynamic tracing is part of their monitoring strategy.

Risk score, explained

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H reflects: Attack Vector Local (requires user shell access), Access Complexity Low (no special conditions), Privilege Level Low (unprivileged user sufficient, though tracepoint must be pre-enabled by root), User Interaction None, Scope Unchanged, Confidentiality None (no data leak), Integrity None (no data corruption), Availability High (kernel crash). The score of 5.5 appropriately captures a local DoS without data compromise, though the ease of triggering and the typical defense-in-depth reliance on kernel stability argue for prompt remediation.

Frequently asked questions