Linux kernel (net/smc): When an SMC-R link is torn down, the kernel moves the QP to Error state and then destroys the

Impact

When an SMC-R link is torn down, the kernel moves the QP to Error state and then destroys the QP and frees the link group without waiting for the outstanding receive work requests to flush. The RDMA completion tasklet then writes into freed link-group memory, giving a fabric peer that can force a link teardown a write-after-free in softirq context on the host - observed as a page fault inside a spinlock acquire, i.e. a node panic, with corruption of adjacent slab objects as the worse case.

Who can reach it

Reachable by any RDMA fabric peer holding an SMC-R link group with the node: the peer simply drives the link down (LLC delete-link, port flap, abrupt teardown) while traffic is in flight. On the victim side all that is required is that SMC-R is in use over an RoCE/IB device; socket(AF_SMC, ...) is unprivileged and autoloads the smc module through the net-pf-43 alias in default distro configs, so a tenant container needs no device node and no capability to bring the code path online.

What to do

Boot a kernel carrying the fix commits (the record publishes no fixed version - check your distro's mapping for this CVE). Interim: prevent the family from loading at all with a modprobe.d entry (blacklist smc plus install smc /bin/false), or block socket family 43 in the tenant seccomp profile, so tenants cannot instantiate SMC-R link groups.

References

Related entries

• Linux kernel (net/smc): When an incoming connection tries SMC-Rv2 and device setup fails, the listener does not resetCVE-2023-53382 · Linux kernel (net/smc)Critical
• Linux kernel (net/smc): On the server side of the SMC-R LLC handshake, adding a second link to a link group runsCVE-2023-54237 · Linux kernel (net/smc)Critical
• Linux kernel (net/smc): The server-side listen worker frees a connection outside the socket lock, so smc_conn_free()CVE-2024-56640 · Linux kernel (net/smc)Critical
• Linux kernel (net/smc): A link-down work item can be queued before the link group is freed but run after, so the workerCVE-2024-56718 · Linux kernel (net/smc)Critical
• Linux kernel (net/smc): The SMC listen worker keeps touching the SMC socket after smc_listen_out() has handed it offCVE-2025-38734 · Linux kernel (net/smc)Critical
• Linux kernel (net/smc): An inbound SYN handled in softirq reads the smc_sock out of the listening TCP socket'sCVE-2026-23450 · Linux kernel (net/smc)Critical