Linux Kernel SMC Use-After-Free Vulnerability in TCP Timer Handler

A use-after-free vulnerability has been identified in the Linux kernel's TCP timer handling, specifically within the Socket Management Channel (SMC) implementation. This issue arises when an SMC-created kernel socket is not properly closed, leaving TCP timers active. The vulnerability can be exploited after the socket is freed, leading to potential memory corruption.

Impact

Exploitation of this vulnerability causes a use-after-free condition, where memory that has been freed is still accessed, potentially leading to arbitrary code execution or memory corruption.

Reproduction

The vulnerability can be reproduced by creating a kernel socket through the SMC interface, then closing the parent SMC socket without properly releasing the associated TCP resources. This leaves the TCP timers running, which can later be triggered, causing the use-after-free condition.

Remediation

Users should upgrade to the latest stable version of the Linux kernel where this vulnerability has been addressed.