01 Record

CVE-2026-64541

net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket

CriticalPUBLISHEDCNA: Linux

CNA base score9.8 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

net/smc: fix UAF in smc_cdc_rx_handler() by pinning the socket

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatableyesAn attacker can reliably automate reconnaissance through exploitation, so this scales.
Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.56% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 46.8% of scored records. A rank, not a probability.

NVD base score

9.8 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD analysis status

Received. NVD last modified this record on 2026-10-19.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-07-27 20:10Z3 MO AGO

Last updated

2026-10-19 20:48Z9 DAYS AGO

Reserved

2026-07-19

Assigning CNA

Linux

Record state

PUBLISHED

Severity

Critical (CVSS 9.8)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-416Use After FreeVariant

Data version

5.2

Document digest

d005c16cd18176c62ad62775f447c301ea6b860f5e01250fd1dc7d7c99bec806

05 Affected products

VendorProductVersionsPlatforms

LinuxLinuxd7b0e37c1ac152905b18a5b9506179091a35b0b6 to < 8de4f665d0febfb92803dece377791a563fc7041, d7b0e37c1ac152905b18a5b9506179091a35b0b6 to < 8145b432136285e01091815b48ceb2dae261f262, d7b0e37c1ac152905b18a5b9506179091a35b0b6 to < 1951bffbc6493ec34cff3956b29d4bc6606904a6, d7b0e37c1ac152905b18a5b9506179091a35b0b6 to < 647b19e5cc145a2f1f685ae8ff3805a17356888c, d7b0e37c1ac152905b18a5b9506179091a35b0b6 to < 472e9d7c0d5b03be3ff91ff941f57da822b031bc, d7b0e37c1ac152905b18a5b9506179091a35b0b6 to < 3bfb96d9bc6a7ed0b99c7db329cc2e22a28d84bb, d7b0e37c1ac152905b18a5b9506179091a35b0b6 to < ce5aa8084329351086894aa34d77e40301d5bd3d, d7b0e37c1ac152905b18a5b9506179091a35b0b6 to < 9d160b35cc34a2ba8229d07651468a7848325135, 4.18—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/8de4f665d0febfb92803dece377791a563fc7041
git.kernel.orghttps://git.kernel.org/stable/c/8145b432136285e01091815b48ceb2dae261f262
git.kernel.orghttps://git.kernel.org/stable/c/1951bffbc6493ec34cff3956b29d4bc6606904a6
git.kernel.orghttps://git.kernel.org/stable/c/647b19e5cc145a2f1f685ae8ff3805a17356888c
git.kernel.orghttps://git.kernel.org/stable/c/472e9d7c0d5b03be3ff91ff941f57da822b031bc
git.kernel.orghttps://git.kernel.org/stable/c/3bfb96d9bc6a7ed0b99c7db329cc2e22a28d84bb
git.kernel.orghttps://git.kernel.org/stable/c/ce5aa8084329351086894aa34d77e40301d5bd3d
git.kernel.orghttps://git.kernel.org/stable/c/9d160b35cc34a2ba8229d07651468a7848325135

07 Fixed in

Debian 12

linux
Fixed in 6.1.180-1
linux-6.12
Fixed in 6.12.100-1~deb12u1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.100-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 7.1.5-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.