Executive brief
The Linux kernel's SMC (Shared Memory Communications) protocol implementation contains a buffer overflow vulnerability when processing SMC-Rv2 link addition messages. An attacker with network access can trigger an out-of-bounds memory read, potentially leading to information disclosure or denial of service on systems using this protocol for high-performance networking.
Technical details
The vulnerability is a slab-out-of-bounds read in smc_llc_save_add_link_rkeys() in net/smc. On links using devices with max_recv_sge == 1, the code incorrectly calculates the address of the SMC-Rv2 extension structure by adding a fixed offset (SMC_WR_TX_SIZE/44 bytes) to the LLC message pointer. Since the allocated queue entry is only 72 bytes, the extension structure at offset 68 overflows the allocation, and accessing ext->num_rkeys at offset 94 reads past the buffer boundary. The vulnerability triggers on every SMC-Rv2 link addition regardless of peer input. This is a network-reachable vulnerability requiring an attacker to send crafted SMC-Rv2 link addition messages. The fix involves bounding the peer rkey counts to prevent out-of-bounds access.
Affected products
- Linux Linux kernel 7.2.0-rc5 and later versions with SMC-Rv2 support
Timeline
- 2026-09-11: disclosed