CVE-2026-74719

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/smc: fix qentry overwrite for CONFIRM_LINK and ADD_LINK_CONT in smc_llc_event_handler()<br /> <br /> The SMC_LLC_CONFIRM_LINK / SMC_LLC_ADD_LINK_CONT branch in<br /> smc_llc_event_handler() stores an incoming qentry into the local LLC flow<br /> without first checking whether a qentry is already pending. If a malicious or<br /> buggy peer sends a second CONFIRM_LINK or ADD_LINK_CONT request while a flow is<br /> active and flow-&gt;qentry is already set, smc_llc_flow_qentry_set() overwrites the<br /> pointer without freeing the previous allocation, leaking one kmalloc-96 object<br /> per spurious message.<br /> <br /> The sibling SMC_LLC_DELETE_LINK branch already has the correct !flow-&gt;qentry<br /> guard. Apply the same guard to the CONFIRM_LINK/ADD_LINK_CONT branch so that a<br /> duplicate message when qentry is already occupied falls through to break and is<br /> freed by the kfree(qentry) at the out: label, rather than silently leaking the<br /> existing allocation.<br /> <br /> The response direction (smc_llc_rx_response()) is unaffected: it already guards<br /> with flow-&gt;qentry at the equivalent site and drops duplicate responses<br /> correctly.