PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-46027 Linux CVE debrief

A race condition in the Linux kernel's Shared Memory Communications (SMC) subsystem could lead to invalid memory access during connection handshake. The vulnerability exists in smc_clc_wait_msg() where CLC decline messages received before link group setup completion could trigger link-group state updates on uninitialized structures. The fix adds proper guards to prevent early link-group access while preserving per-socket peer diagnosis handling.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-16
Advisory published
2026-05-27
Advisory updated
2026-06-16

Who should care

Organizations running Linux kernels with SMC-R (Shared Memory Communications over RDMA) enabled, particularly on IBM Z, LinuxONE, or x86_64 systems using RoCE adapters for high-performance networking workloads.

Technical summary

The vulnerability is a race condition in net/smc/smc_clc.c where smc_clc_wait_msg() processes CLC decline messages. When a decline arrives during early handshake before link group association, the code attempted to update link-group level sync state that doesn't yet exist. The fix adds a guard condition to skip link-group updates when the connection hasn't completed link group setup, while maintaining the existing per-socket peer diagnosis path. This prevents null or invalid pointer dereferences on link-group structures during the vulnerable window.

Defensive priority

medium

Recommended defensive actions

  • Apply kernel updates from stable branches when available from distribution vendors
  • Monitor NVD for CVSS scoring once analysis completes
  • Review SMC usage in environments running RDMA over Converged Ethernet (RoCE) workloads
  • Validate kernel version against patched commits in stable trees

Evidence notes

Official CVE record published 2026-05-27T14:17:21.303Z. NVD status: Awaiting Analysis. Five kernel.org stable branch commits provided as references. No CVSS score or severity assigned by NVD at time of disclosure.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-46027 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-46027

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-46027 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-46027

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/5a8db80f721deee8e916c2cfdee78decda02ce4f

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/6180a296ca65b08a81914805cbc0f78da5f10a1f

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/83bcf9228b0501694fb2589ed1d142855a2887f2

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ea0b5d0fe96356dce38f98375a57c52a04e13712

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f0858e1d5624bb120b198f2a8528f97a9b0ae069

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.