Linux kernel SMC-D client (CHID matching against unpopulated ism_dev slot): Slot 0 of the client's ISM device array is

Impact

Slot 0 of the client's ISM device array is reserved for a V1 device and left zeroed when only V2 devices are found. The accepted-CHID matcher compares from index 0 using the CHID alone, so a malicious server replying with CHID 0 matches the empty slot, the client selects a NULL device, and the following lgr_lock dereference faults. The client is the victim here: a hostile SMC server crashes every node that connects to it.

Who can reach it

Remote, from the server side. A malicious or compromised SMC peer answers a V2-only proposal with CHID 0.

What to do

Kernel update rejecting a CHID-0 match against an empty slot. Do not let tenant workloads act as SMC servers for host-level clients, and keep SMC disabled where it is not intentional.

References