Linux kernel SMC-R: use-after-free of the LLC queue entry when adding a second RDMA link

Impact

On a server accepting SMC-R connections, smc_llc_srv_add_link() keeps a pointer into an LLC queue entry that has already been kfree()d, then reads the ADD_LINK rkey data out of it. On a link without a shared v2 receive buffer (max_recv_sge == 1) the freed slab object is read on every second-link setup, which a peer on the RoCE/InfiniBand fabric drives during normal link-group formation. The reachable outcome is freed-memory reads in a softirq/workqueue context, so the practical risk is kernel memory disclosure into LLC state or a crash of the SMC listener. This only matters on fleets that actually enable SMC-R over RoCE for east-west traffic; the fabric is shared across tenants, so the peer that drives the path need not be trusted.

Who can reach it

A remote SMC-R peer that can complete a link group with the host over RDMA, i.e. anyone reachable on the storage or east-west fabric. No local access and no authentication beyond being an accepted SMC peer; the module must be loaded and SMC in use.

What to do

Take the stable-kernel fix from one of the linked kernel.org commits and reboot the node; there is no hot patch and no runtime toggle short of preventing SMC-R link groups from forming. Operators who do not use SMC can confirm the smc module is not loaded and treat this as not applicable. Fixed versions are given by the stable commits only - the record names no release number.

References

Related entries

• Linux NFSD: use-after-free in the inter-server copy mount expiry walkCVE-2026-89712 · Linux kernel NFSD (inter-server copy, nfsd4_ssc_expire_umount)Critical
• Linux kernel qla2xxx: double completion in async IOCB timeout frees a live stack frameCVE-2026-89847 · Linux kernel qla2xxx (async IOCB timeout completion handling)Critical
• Linux kernel qla2xxx: NVMe LS reject path advances the request ring without the qpair lockCVE-2026-89857 · Linux kernel qla2xxx (NVMe-FC LS reject, request ring locking)Critical
• Linux kernel nvmet-tcp: over-long PDU writes past the 128-byte receive bufferCVE-2026-89969 · Linux kernel nvmet-tcp (NVMe-over-TCP target PDU receive)Critical
• Linux kernel nvmet-auth: use-after-free when auth timeout work races SQ teardownCVE-2026-89970 · Linux kernel nvmet-auth (NVMe target SQ teardown)Critical
• Linux kernel nvme: missing SRCU grace period on the namespace-allocation error pathCVE-2026-89972 · Linux kernel nvme host (nvme_alloc_ns error path, multipath sibling list)Critical