Executive brief
The Linux kernel's SMC (Shared Memory Communications) networking protocol handler incorrectly processes oversized protocol messages in version 2 (Rv2), allowing attackers to read or manipulate kernel memory through malformed LLC (Link Level Control) messages. This could lead to unauthorized access to sensitive data, denial of service, or privilege escalation on systems using SMC for RDMA networking.
Technical details
The vulnerability exists in the SMC-Rv2 LLC message processing functions (smc_llc_rmt_delete_rkey and smc_llc_save_add_link_rkeys) which read beyond the 44-byte fixed union smc_llc_msg structure. When a DELETE_RKEY_V2 message declares 255 rkeys but only carries 9, the code bounds checks against the receive buffer size rather than the actual message size, causing it to read uninitialized kernel memory from prior messages. An attacker with network access can send specially crafted LLC messages to trigger this out-of-bounds read or write, potentially deleting legitimate rtokens or installing malicious ones. The fix copies the message tail into a queue entry with proper length tracking and properly bounds rkey processing.
Affected products
- Linux Linux Kernel All versions with SMC-Rv2 support (v5.16 and later affected based on referenced commits)
Timeline
- 2026-09-11: disclosed: CVE-2026-80985 published
- 2026-08-22: patched: Fix merged upstream (commit 8d3c1ab82c11d4fadebf817a825fd221b3e197ea)