Linux kernel SMC (CLC message drain loop, unchecked sock_recvmsg return): The length field in the CLC header is

Impact

The length field in the CLC header is attacker-supplied, and when it exceeds the local buffer the code drains the remainder without checking the receive return value - so a peer that declares a huge length and then stops sending puts the kernel in an unbounded drain loop. One connection from an unauthenticated peer wedges a kernel thread; a handful wedge the node.

Who can reach it

Remote, unauthenticated. Send a CLC header with an oversized length and withhold the rest.

What to do

Kernel update checking the sock_recvmsg return during the drain. Keep AF_SMC unreachable from tenant networks where SMC is not in use.

References