CVE-2026-64048 Linux CVE debrief

Who should care

Users of the Linux kernel, specifically those using the SMC-D client, should be aware of this vulnerability. This includes Linux kernel developers, maintainers, and users who need to apply patches or take mitigations to prevent exploitation. Additionally, security teams and vulnerability management teams should be aware of this vulnerability and review their systems for potential exposure.

Technical summary

The vulnerability is caused by a malicious peer replying to a SMC-Dv2-only proposal with d1.chid == 0, which matches the empty slot, ini->ism_selected becomes 0, and the subsequent ism_dev[0]->lgr_lock dereference in smc_conn_create() faults. The fix requires ism_dev[i] to be non-NULL before accepting a CHID match. This vulnerability affects the SMC-D client in the Linux kernel, where slot 0 of ini->ism_dev[]/ini->ism_chid[] is reserved for an SMC-Dv1 device. The vulnerability can be resolved by requiring ism_dev[i] to be non-NULL before accepting a CHID match.

Defensive priority

Medium

Recommended defensive actions

• Apply the patch
• Monitor for updates
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance

Evidence notes

The CVE record was published on 2026-07-19T16:17:45.190Z and has not been modified since then. The Linux kernel vulnerability (CVE-2026-64048) was found in the net/smc module, specifically in the SMC-D client. The vulnerability allows a malicious peer to reply to a SMC-Dv2-only proposal with d1.chid == 0, matching an empty slot. This causes ini->ism_selected to become 0, leading to a null pointer dereference in smc_conn_create(). The fix requires ism_dev[i] to be non-NULL before accepting a CHID match. Users should verify their Linux kernel versions and apply patches if necessary.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.