Linux kernel (net/smc): When an SMC-R link is torn down, the kernel moves the QP to Error state and then destroys the

Impact

When an SMC-R link is torn down, the kernel moves the QP to Error state and then destroys the QP and frees the link group without waiting for the outstanding receive work requests to flush. The RDMA completion tasklet then writes into freed link-group memory, giving a fabric peer that can force a link teardown a write-after-free in softirq context on the host - observed as a page fault inside a spinlock acquire, i.e. a node panic, with corruption of adjacent slab objects as the worse case.

Who can reach it

Reachable by any RDMA fabric peer holding an SMC-R link group with the node: the peer simply drives the link down (LLC delete-link, port flap, abrupt teardown) while traffic is in flight. On the victim side all that is required is that SMC-R is in use over an RoCE/IB device; socket(AF_SMC, ...) is unprivileged and autoloads the smc module through the net-pf-43 alias in default distro configs, so a tenant container needs no device node and no capability to bring the code path online.

What to do

Boot a kernel carrying the fix commits (the record publishes no fixed version - check your distro's mapping for this CVE). Interim: prevent the family from loading at all with a modprobe.d entry (blacklist smc plus install smc /bin/false), or block socket family 43 in the tenant seccomp profile, so tenants cannot instantiate SMC-R link groups.

References