# CVE-2026-99032: net/smc: protect clcsock lifetime in smc_getname

CVE-2026-99032 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-99032, released October 24, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-99032
- Priority: High
- CVSS: 7.8 (Important)
- EPSS: 0.0016
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 23, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-99032

## Description

In the Linux kernel, the following vulnerability has been resolved:  net/smc: protect clcsock lifetime in smc_getname  smc_getname() dereferences smc->clcsock without holding clcsock_release_lock. Link-group termination can release the CLC socket through smc_close_active_abort() while the SMC socket is still open, for example after shutdown(SHUT_WR).  A getsockname() caller can load smc->clcsock, then the termination worker can clear the pointer and call sock_release() before the caller accesses clcsock->ops or invokes getname(). This causes a use-after-free; if the worker clears the pointer before the load, it causes a NULL dereference. The syscall's file reference keeps the SMC socket alive but does not prevent asynchronous release of its CLC socket.  KASAN reported the following with test-only timing instrumentation:    BUG: KASAN: slab-use-after-free in smc_getname+0x19e/0x1b0   Read of size 8 at addr ffff888109abb4e0 by task poc/103   Call Trace:    smc_getname+0x19e/0x1b0    do_getsockname+0xe5/0x170    __sys_getsockname+0x8c/0x100    Allocated by task 95:    sock_alloc_inode+0x1e/0x280    sock_alloc+0x3d/0x240    __sock_create+0x7e/0x430    smc_create+0x121/0x240    Freed by task 0:    kmem_cache_free+0xcc/0x340    rcu_core+0x50a/0x1850    Last potentially related work creation:    evict+0x446/0x6c0    smc_clcsock_release+0xa8/0xd0    smc_close_active_abort+0x26a/0x3a0    __smc_lgr_terminate.part.0+0x137/0x2e0  Hold clcsock_release_lock across the pointer check and the getname() callback to serialize with smc_clcsock_release(). Return -EBADF if the CLC socket has already been released, preserving the existing peer state check and the callback's return value otherwise.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 13.5 (trixie) | 6.12.113-1 | [DEBIAN-CVE-2026-99032](https://patchblox.com/security/data/fix/linux/debian-cve-2026-99032.md) | Oct 24, 2026 |
| Linux | linux Debian 14 | 7.2.11-1 | [DEBIAN-CVE-2026-99032](https://patchblox.com/security/data/fix/linux/debian-cve-2026-99032.md) | Oct 24, 2026 |

---

Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.