External risk intelligence

Linux Kernel Use-After-Free in smc_llc_srv_add_link

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-80981

This vulnerability exists within a deep, internal component of the Linux kernel (Shared Memory Communications over RDMA) used for low-level network link management. It is not an application, service, or interface exposed to the internet. It requires local execution to reach the vulnerable code path.

Use After Free

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Linux kernel's Shared Memory Communications networking component could allow for unauthorized access and manipulation of data. This issue stems from a use-after-free error in how network links are managed, potentially leading to system instability or data compromise. The main concern is confirming relevance and exposure.

Kernel networking component has a data handling flaw.
This could allow unauthorized access or data manipulation.
Confirm relevance and exposure of this kernel issue.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by triggering a specific race condition within the Linux kernel's Shared Memory Communications (SMC) networking component. This race condition occurs when managing network links, leading to a use-after-free error. When successful, this could result in a system crash or other unintended behavior.

Vulnerable if network links are managed.
Triggered by a race condition during link operations.
Risk of system instability or crash.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in the Linux kernel's Shared Memory Communications over RDMA (SMC-R) component could lead to a crash when handling network link management. This could occur under specific conditions related to how the kernel processes queue entries for link operations, particularly when certain receive buffer configurations are not used.

System stability could be affected.
A use-after-free could occur.
The system may crash.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides within the Linux kernel's Shared Memory Communications over RDMA (SMC-R) implementation. System owners and kernel developers are the primary parties responsible for addressing this. The immediate practical step is to identify Linux systems utilizing SMC-R, assess their exposure, and confirm the need for a kernel update.

Kernel owners are responsible for remediation.
Verify SMC-R usage and system criticality.
Plan for kernel updates during maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel's SMC-R component?

SMC-R, or Shared Memory Communications over RDMA, is a networking protocol within the Linux kernel designed to optimize data transfer. It allows applications to achieve high-performance communication by bypassing traditional networking overheads, effectively treating memory across different systems as if it were local. It is typically used in specialized, high-bandwidth data center environments to facilitate low-latency connections.

What is the use-after-free weakness in CVE-2026-80981?

A use-after-free is a memory management error where software continues to use a pointer to a location in memory after that memory has been released or freed. In the context of CVE-2026-80981, the kernel improperly accesses a specific network structure after it has been deleted, which can lead to unpredictable behavior, memory corruption, or system instability.

How is this use-after-free error triggered?

The vulnerability is triggered by a specific race condition during the management of network links. It occurs when the kernel frees a queue entry for a link operation while simultaneously attempting to read that same entry. Crucially, the issue does not trigger when the system is configured to use a shared V2 receive buffer, as the code path uses a different memory reference in that specific scenario.

Do I need to worry about external access for CVE-2026-80981?

According to Halo Surface Signal, this vulnerability is very unlikely to be reachable from the internet. The affected code exists deep within internal, low-level kernel routines managing network links. Because it requires specific, local conditions to reach the vulnerable path, it is generally not exposed as a direct service or interface to external network traffic.

How should I respond to this kernel vulnerability?

The primary response is to determine if your Linux systems actively utilize the SMC-R protocol. If you identify environments running this technology, consult your distribution vendor to identify if a kernel update addressing this specific link management flaw is available. Plan to apply the updated kernel during your next standard maintenance cycle.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.