Linux kernel SMC-R/SMC-D (CLC proposal parsing, iparea_offset / ipv6_prefixes_cnt): Third instance of the same class in

Impact

Third instance of the same class in the same handshake parser - the IP-area offset and the IPv6 prefix count are taken from the remote client without bounds checks, giving an unauthenticated peer an out-of-bounds read on the server. That three separate patches were needed for one message format is the real finding: the SMC CLC parser was written assuming a cooperative peer, and an operator should treat the whole surface as untrusted rather than patching field by field.

Who can reach it

Remote, unauthenticated, first message of the SMC handshake.

What to do

Kernel update validating iparea_offset and ipv6_prefixes_cnt. Given the pattern, the durable control is not exposing AF_SMC on tenant-reachable interfaces at all unless SMC acceleration is a deliberate design choice.

References