PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-64048 Linux CVE debrief

A vulnerability was found in the Linux kernel, specifically in the net/smc module. The vulnerability, known as CVE-2026-64048, affects the SMC-D client. An issue arises when slot 0 of ini->ism_dev[]/ini->ism_chid[] is reserved for an SMC-Dv1 device and left in its kzalloc()'ed state with ism_dev[0] == NULL and ism_chid[0] == 0. A malicious peer can reply to a SMC-Dv2-only proposal with d1.chid == 0, matching the empty slot. This causes ini->ism_selected to become 0, leading to a null pointer dereference in smc_conn_create() at offsetof(struct smcd_dev, lgr_lock) == 0x68. The fix requires ism_dev[i] to be non-NULL before accepting a CHID match. Users of the Linux kernel should be aware of this vulnerability and take necessary actions.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-19
Original CVE updated
2026-07-19
Advisory published
2026-07-19
Advisory updated
2026-07-19

Who should care

Users of the Linux kernel, specifically those using the SMC-D client, should be aware of this vulnerability. This includes Linux kernel developers, maintainers, and users who need to apply patches or take mitigations to prevent exploitation. Additionally, security teams and vulnerability management teams should be aware of this vulnerability and review their systems for potential exposure.

Technical summary

The vulnerability is caused by a malicious peer replying to a SMC-Dv2-only proposal with d1.chid == 0, which matches the empty slot, ini->ism_selected becomes 0, and the subsequent ism_dev[0]->lgr_lock dereference in smc_conn_create() faults. The fix requires ism_dev[i] to be non-NULL before accepting a CHID match. This vulnerability affects the SMC-D client in the Linux kernel, where slot 0 of ini->ism_dev[]/ini->ism_chid[] is reserved for an SMC-Dv1 device. The vulnerability can be resolved by requiring ism_dev[i] to be non-NULL before accepting a CHID match.

Defensive priority

Medium

Recommended defensive actions

  • Apply the patch
  • Monitor for updates
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record was published on 2026-07-19T16:17:45.190Z and has not been modified since then. The Linux kernel vulnerability (CVE-2026-64048) was found in the net/smc module, specifically in the SMC-D client. The vulnerability allows a malicious peer to reply to a SMC-Dv2-only proposal with d1.chid == 0, matching an empty slot. This causes ini->ism_selected to become 0, leading to a null pointer dereference in smc_conn_create(). The fix requires ism_dev[i] to be non-NULL before accepting a CHID match. Users should verify their Linux kernel versions and apply patches if necessary.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-19T16:17:45.190Z and has not been modified since then.