CVE-2026-46027 Details
Description
In the Linux kernel, the following vulnerability has been resolved: net/smc: avoid early lgr access in smc_clc_wait_msg A CLC decline can be received while the handshake is still in an early stage, before the connection has been associated with a link group. The decline handling in smc_clc_wait_msg() updates link-group level sync state for first-contact declines, but that state only exists after link group setup has completed. Guard the link-group update accordingly and keep the per-socket peer diagnosis handling unchanged. This preserves the existing sync_err handling for established link-group contexts and avoids touching link-group state before it is available.
A vulnerability in the Linux kernel's handling of Socket Memory Copy (SMC) Connection Link Control (CLC) messages can lead to improper synchronization within link groups. This issue arises because a CLC decline can be received during the early stages of the handshake process, before the connection is linked to a group. The current decline management updates the link-group synchronization state for initial declines, but this state is only established after the link group setup is finalized. The vulnerability has been addressed by modifying the decline handling to prevent premature access to the link-group state, while maintaining the existing peer diagnosis management for individual sockets. This fix ensures that established link-group contexts are not disrupted and that synchronization errors are only handled when the link group state is fully available.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for downloading the patched version are available on the Linux Kernel Archives.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/22546729b96fc873b23065dc49e3d73c45cfb874 | kernel.org | Patch |
| https://git.kernel.org/stable/c/257cdf0c5ced9c0fba8aba501d94b0a5fcef2086 | kernel.org | Patch |
| https://git.kernel.org/stable/c/5a8db80f721deee8e916c2cfdee78decda02ce4f | kernel.org | Patch |
| https://git.kernel.org/stable/c/5eedbfd82c2884e0010fdfb3c9446a6ebcadb691 | kernel.org | Patch |
| https://git.kernel.org/stable/c/6180a296ca65b08a81914805cbc0f78da5f10a1f | kernel.org | Patch |
| https://git.kernel.org/stable/c/83bcf9228b0501694fb2589ed1d142855a2887f2 | kernel.org | Patch |
| https://git.kernel.org/stable/c/ea0b5d0fe96356dce38f98375a57c52a04e13712 | kernel.org | Patch |
| https://git.kernel.org/stable/c/f0858e1d5624bb120b198f2a8528f97a9b0ae069 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 4.11, < 5.10.258 >= 5.11, < 5.15.209 >= 5.16, < 6.1.175 >= 6.2, < 6.6.140 >= 6.7, < 6.12.86 >= 6.13, < 6.18.27 >= 6.19, < 7.0.4 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| Jun 16, 2026 | Initial Analysis | [email protected] |
| Jun 1, 2026 | CVE Modified | kernel.org |
| May 30, 2026 | CVE Modified | kernel.org |
| May 27, 2026 | New CVE Received | kernel.org |