CVE-2026-80980

A MODERATE severity concurrency flaw was found in the Linux kernel's SMC protocol implementation. The three connection state flags killed, freed, and out_of_sync are single-bit bitfields that share one byte of struct smc_connection, and they are not written under a common lock: out_of_sync is set from the receive tasklet in smc_cdc_msg_validate(), while killed is set from process context under lock_sock() in smc_conn_kill(). Concurrent stores to these flags therefore perform unsynchronized read-modify-write operations on the shared byte, which can result in incorrect connection state management, unexpected behavior, or a denial of service. Red Hat scored this flaw CVSS 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), which differs substantially from the upstream CVEORG score of 9.8 because, per the Red Hat assessment, triggering the flaw requires local access to establish SMC connections and impacts only availability, with no direct impact on confidentiality or integrity. The vulnerable code is present in the kernel packages of Red Hat Enterprise Linux 8, 9, and 10 and in the RHCOS kernels shipped with OpenShift Container Platform 4, which are marked affected; the Red Hat Enterprise Linux 6 and 7 ELS kernels do not contain this code and are not affected. Because the impact is MODERATE with a CVSS score below the 7.0 threshold, the fix is deferred and no bug trackers are being filed for this issue at this time; the residual risk is limited to potential connection state corruption or denial of service on systems actively using SMC connections.