smc RxTasklet UAF

Vulnerability analysis

A race condition in the SMC-D connection teardown path allows a receive tasklet to be re-armed by an incoming device interrupt after it has already been drained, leading to a use-after-free when the tasklet dereferences a send buffer that was freed immediately after the drain. The window opens when a link group is unlinked from its device list but connection killing is deferred to a work item — during this gap the connection's device slot stays registered, so the interrupt handler can re-arm the tasklet. The fix unregisters the connection unconditionally before draining the tasklet, ensures the tasklet is fully stopped before freeing any buffers at both teardown sites, and clears the send buffer pointer before freeing it so concurrent readers cannot sample a stale pointer. The vulnerability is reachable by any peer on the same ISM fabric (typically another LPAR on the same IBM Z machine) who can establish an SMC-D connection, or by a local unprivileged process with network access; no special privileges are required on the target system.