smc ConnFlags Race

Vulnerability analysis

The SMC protocol tracks three connection lifecycle flags — killed, freed, and out-of-sync — as single-bit bitfields sharing one byte in the connection structure. Because writing any one flag is a read-modify-write of the entire byte, and these flags are updated from different execution contexts without a common lock (the receive path sets one flag from a tasklet while connection teardown sets another from process context), concurrent writes can silently clobber each other's values. The resulting flag corruption can cause a connection to be used after it has been freed or prevent proper termination, leading to use-after-free or double-free conditions. The fix gives each flag its own byte so that a store to one no longer touches the others, eliminating the inter-flag race. An attacker who can send SMC CDC messages to a target — by being the SMC peer or intercepting traffic between peers — can trigger the receive-path write; if it races with local connection teardown, the corrupted flags open a path to kernel memory corruption.