Linux kernel SMC-R/SMC-D (CLC proposal parsing, v2_ext_offset / eid_cnt / ism_gid_cnt): The same unvalidated-offset

Impact

The same unvalidated-offset pattern, this time across three remote-controlled fields at once - the V2 extension offset plus two counts that determine how many entries the server then walks. An unauthenticated peer sets the offset out of range and the count high, and the server reads far past its buffer. Three fields is worse than one: the counts turn a single bad read into a bounded-by-the-attacker sweep.

Who can reach it

Remote, unauthenticated, in the first message of the SMC handshake.

What to do

Kernel update validating all three fields before use. Confirm whether SMC is actually in use in your fleet; if not, keep the module unloaded.

References

Related entries

• Linux kernel mlx5_core kTLS TX offload: The kTLS TX path mixes get_page() and page_ref_inc() when acquiring referencesCVE-2024-53138 · Linux kernel mlx5_core kTLS TX offloadCritical
• Linux kernel (net/smc): The server-side listen worker frees a connection outside the socket lock, so smc_conn_free()CVE-2024-56640 · Linux kernel (net/smc)Critical
• Linux kernel (net/smc): A link-down work item can be queued before the link group is freed but run after, so the workerCVE-2024-56718 · Linux kernel (net/smc)Critical
• Linux kernel (net/tls): The synchronous decrypt path shared refcounting and completion state with the async path, so aCVE-2024-58240 · Linux kernel (net/tls)Critical
• Linux kernel (drivers/nvme/target): The target disables a namespace without waiting for in-flight I/O to drain, so aCVE-2025-21850 · Linux kernel (drivers/nvme/target)Critical
• Linux kernel - NVMe/TCP host (initiator), drivers/nvme/host/tcp.c: Nvme_tcp_recv_pdu() did not validate the PDU headerCVE-2025-21927 · Linux kernel - NVMe/TCP host (initiator), drivers/nvme/host/tcp.cCritical