CVE-2026-46330: Revert "net/smc: Introduce TCP ULP support"

Synopsis

A use-after-free vulnerability exists in the Linux kernel's SMC (Shared Memory Communications) subsystem, specifically in the TCP ULP (Upper Layer Protocol) support feature introduced in kernel versions starting from commit d7cd421da9da2cc7b4d25b8537f66db5c8331c40. The flaw is exploitable locally by any user with a low-privilege account, requiring no network access or user interaction. Successful exploitation allows an attacker to read memory, corrupt data, or crash the system entirely. A patched-image rebuild is available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the target service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient; no administrative or elevated credentials are needed.

• Victim interactionNot required

  The exploit executes without requiring any action from another user or process on the system.

• Attack complexityDetail

  The exploit is reliable and condition-free; no race conditions, specific memory layouts, or environmental prerequisites are required.

Blast Radius

• Reads arbitrary kernel memory, which may expose credentials, session tokens, or sensitive process data from other users on the same host.
• Modifies kernel data structures in-place, enabling tampering with kernel state or other processes running on the system.
• Crashes the affected kernel, taking down all workloads on the host and causing a full service disruption.
• Corrupts VFS (virtual filesystem) internals via the broken in-place inode and dentry modification, potentially destabilizing any open file operations across the system.