CVE-2026-52941

In the Linux kernel, the following vulnerability has been resolved:

net/smc: avoid NULL deref of conn->lnk in smcmsgevent tracepoint

The smcmsgevent tracepoint class, shared by smctxsendmsg and smcrxrecvmsg, unconditionally dereferences smc->conn.lnk:

__string(name, smc->conn.lnk->ibname)

conn->lnk is only set for SMC-R; for SMC-D it is NULL. Other code on these paths already handles this (e.g. !conn->lnk in SMCSTATRMBTXSIZE_SMALL()). With the tracepoint enabled, the first sendmsg()/recvmsg() on an SMC-D socket crashes:

Oops: general protection fault, probably for non-canonical address KASAN: null-ptr-deref in range [...] RIP: 0010:strlen+0x1e/0xa0 Call Trace: traceeventraweventsmcmsgevent (net/smc/smctracepoint.h:44) smcrxrecvmsg (net/smc/smcrx.c:515) smcrecvmsg (net/smc/afsmc.c:2859) __sys_recvfrom (net/socket.c:2315) __x64sysrecvfrom (net/socket.c:2326) dosyscall64

The faulting address 0x3e0 is offsetof(struct smclink, ibname), confirming the NULL ->lnk deref. Enabling the tracepoint requires root, but the trigger itself is unprivileged: socket(AFSMC, ...) has no capability check, and SMC-D negotiation needs no admin step on s390 or on x86 with the loopback ISM device loaded.

Log an empty device name for SMC-D instead of dereferencing NULL.