Linux kernel SMC-R/SMC-D (CLC proposal parsing, v2_ext_offset / eid_cnt / ism_gid_cnt): The same unvalidated-offset

Impact

The same unvalidated-offset pattern, this time across three remote-controlled fields at once - the V2 extension offset plus two counts that determine how many entries the server then walks. An unauthenticated peer sets the offset out of range and the count high, and the server reads far past its buffer. Three fields is worse than one: the counts turn a single bad read into a bounded-by-the-attacker sweep.

Who can reach it

Remote, unauthenticated, in the first message of the SMC handshake.

What to do

Kernel update validating all three fields before use. Confirm whether SMC is actually in use in your fleet; if not, keep the module unloaded.

References