CVE-2026-64048

In the Linux kernel, the following vulnerability has been resolved:

net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot

On the SMC-D client, slot 0 of ini->ismdev[]/ini->ismchid[] is reserved for an SMC-Dv1 device. smcfindismv2deviceclnt() populates V2 entries starting at index 1, so when no V1 device is selected slot 0 is left in its kzalloc()'ed state with ismdev[0] == NULL and ism_chid[0] == 0.

smcv2determineacceptedchid() then matches the peer's CHID against the array starting from index 0 using the CHID alone. A malicious peer replying to a SMC-Dv2-only proposal with d1.chid == 0 matches the empty slot, ini->ismselected becomes 0, and the subsequent ismdev[0]->lgrlock dereference in smcconncreate() faults at offsetof(struct smcddev, lgr_lock) == 0x68:

BUG: KASAN: null-ptr-deref in rawspinlockbh+0x79/0xe0 Write of size 4 at addr 0000000000000068 by task exploit/144 Call Trace: rawspinlockbh smcconncreate (net/smc/smc_core.c:1997) __smcconnect (net/smc/afsmc.c:1447) smcconnect (net/smc/afsmc.c:1720) __sys_connect __x64sysconnect dosyscall64

Require ism_dev[i] to be non-NULL before accepting a CHID match.