Linux kernel (net/smc): The early link-group cleanup path deletes the list head instead of the link group, so the group

Impact

The early link-group cleanup path deletes the list head instead of the link group, so the group stays on the global list and is then memset while still linked. Subsequent list operations write through a poisoned pointer - the published failure is a list-corruption BUG in the link-down worker, and the same defect gives an attacker who can force early link-group teardown a controlled-ish write into freed memory.

Who can reach it

Driven from the fabric: the cleanup path runs when link-group setup aborts early, which a peer can force by failing or aborting the CLC handshake, and the crash was observed from the smc_link_down worker (a fabric link event). Local tenants reach the same path through repeated AF_SMC connect attempts; socket(AF_SMC, ...) is unprivileged and autoloads the module.

What to do

Boot a kernel carrying the fix commits. Interim: blacklist the smc module or block socket family 43 for tenants on nodes that do not intentionally run SMC-R.

References