CVE-2026-52941

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/smc: avoid NULL deref of conn-&gt;lnk in smc_msg_event tracepoint<br /> <br /> The smc_msg_event tracepoint class, shared by smc_tx_sendmsg and<br /> smc_rx_recvmsg, unconditionally dereferences smc-&gt;conn.lnk:<br /> <br /> __string(name, smc-&gt;conn.lnk-&gt;ibname)<br /> <br /> conn-&gt;lnk is only set for SMC-R; for SMC-D it is NULL. Other code on<br /> these paths already handles this (e.g. !conn-&gt;lnk in<br /> SMC_STAT_RMB_TX_SIZE_SMALL()). With the tracepoint enabled, the first<br /> sendmsg()/recvmsg() on an SMC-D socket crashes:<br /> <br /> Oops: general protection fault, probably for non-canonical address<br /> KASAN: null-ptr-deref in range [...]<br /> RIP: 0010:strlen+0x1e/0xa0<br /> Call Trace:<br /> trace_event_raw_event_smc_msg_event (net/smc/smc_tracepoint.h:44)<br /> smc_rx_recvmsg (net/smc/smc_rx.c:515)<br /> smc_recvmsg (net/smc/af_smc.c:2859)<br /> __sys_recvfrom (net/socket.c:2315)<br /> __x64_sys_recvfrom (net/socket.c:2326)<br /> do_syscall_64<br /> <br /> The faulting address 0x3e0 is offsetof(struct smc_link, ibname),<br /> confirming the NULL -&gt;lnk deref. Enabling the tracepoint requires<br /> root, but the trigger itself is unprivileged: socket(AF_SMC, ...) has<br /> no capability check, and SMC-D negotiation needs no admin step on<br /> s390 or on x86 with the loopback ISM device loaded.<br /> <br /> Log an empty device name for SMC-D instead of dereferencing NULL.