Database/Kernel, userspace & hypervisor
Linux kernel (net/smc): The IB port-up handler walks the global link-group list without holding its lock, so a fabric
Impact
The IB port-up handler walks the global link-group list without holding its lock, so a fabric port event racing tenant connect/disconnect activity dereferences a link group that is being added or freed underneath it. The published crash is a NULL dereference in smcr_port_add from the IB port-event worker - a node panic that a peer or a flapping fabric link can provoke while tenants are churning connections.
Who can reach it
Adjacent-network: the trigger is an RDMA port event (link up/flap on the RoCE/IB port), which any fabric-side disturbance produces, raced against link-group list mutation driven by tenant SMC connections. No tenant privilege is needed on either side - the tenants only have to be creating and tearing down AF_SMC connections, which is unprivileged and autoloads the module. Link flaps are routine in a large GPU-cluster fabric, so this is not a contrived race.
What to do
Boot a kernel carrying the fix commits (takes smc_lgr_list.lock around the iteration). Interim: blacklist smc on nodes not using SMC-R; there is no way to suppress port events on a live fabric, so patching is the real control.
References
Related entries
- Linux kernel (net/smc): The CLC prefix-match check on the listen path dereferences the destination cache entry'sCVE-2025-40168 · Linux kernel (net/smc)High
- Linux kernel (net/smc): The CDC send-completion handler takes a lock inside an smc_sock that close() has already freedCVE-2021-46925 · Linux kernel (net/smc)High
- Linux kernel (net/smc): An unprivileged tenant that opens an AF_SMC socket, registers it with epoll, and lets theCVE-2022-48721 · Linux kernel (net/smc)High
- Linux kernel (net/smc): Closing an SMC socket can leave the internal TCP kernel socket with its timers still armed andCVE-2023-53781 · Linux kernel (net/smc)High
- Linux kernel (net/smc): SMC-D loopback registers DMBs (the direct memory buffers a peer reads and writes) out ofCVE-2025-40012 · Linux kernel (net/smc)High
- Linux kernel (net/smc): Connect() on an SMC socket takes the destination device pointer out of the dst cache without aCVE-2025-40064 · Linux kernel (net/smc)High
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.