CVE-2026-64048
Description
A flaw was found in the Linux kernel's Server-Message-Block Direct (SMC-D) client. A remote attacker can exploit this vulnerability by sending a specially crafted SMC-Dv2 proposal with a Channel Identifier (CHID) of 0. This malicious proposal can cause a null pointer dereference in the kernel's SMC connection creation process, leading to a system crash and a Denial of Service (DoS).
Statement
A NULL pointer dereference in the SMC-D client CHID selection path can occur because CHID 0 from a peer can match the empty reserved slot 0 when no SMC-Dv1 device is selected. A malicious SMC peer can reply to an SMC-Dv2 only proposal with CHID 0, causing the client to select a NULL ISM device and later dereference lgr_lock during connection setup. For the CVSS the PR:N is used because the attacker only needs to control the peer endpoint or traffic seen by the SMC client, not a local account on the victim. The issue is network reachable in deployments where SMC-D or SMC-Dv2 negotiation is enabled and a client connects to an attacker controlled peer. Impact is denial of service only because the primitive shown by the code is a NULL pointer dereference, not UAF or controllable memory corruption.
Mitigation
Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
