Linux kernel SMC-R/SMC-D (CLC proposal parsing, smcd_v2_ext_offset): The SMC server trusted an offset field taken

Impact

The SMC server trusted an offset field taken straight out of the connecting client's CLC proposal message. Exceeding the maximum turns it into an arbitrary displacement into the parsing buffer - out-of-bounds access chosen by an unauthenticated remote peer. SMC matters here because it is the transparent RDMA acceleration path: LD_PRELOAD smc_run in front of an ordinary TCP application and its sockets silently become RoCE, so this parser sits in front of workloads whose operators do not know they are running an RDMA protocol stack at all.

Who can reach it

Remote, unauthenticated. The CLC proposal is the first SMC message a client sends; parsing happens before anything is established.

What to do

Kernel update bounds-checking smcd_v2_ext_offset. Immediate mitigation: if SMC is not deliberately used, ensure the smc module is not loaded and that AF_SMC is not reachable - on many distro kernels it autoloads, so check rather than assume.

References