Linux kernel net/smc: oversized SMC-Rv2 LLC messages let a peer delete or install RDMA rkeys

Impact

SMC-R runs on top of RoCE/InfiniBand, so the peer here is another host on the storage or east-west fabric. The LLC handlers read the tail of a v2 message bounded by the size of the buffer it landed in rather than by what actually arrived: a 44-byte DELETE_RKEY_V2 that declares 255 rkeys is processed against whatever a previous message left in the shared v2 receive buffer, and the kernel hands those stale values to smc_rtoken_delete(). The reporter observed one of the 255 matching a registered rtoken and deleting it; an ADD_LINK on such a link installs up to 255 rtokens from the same stale bytes. That means a peer on the fabric can tear down or plant RDMA memory-region tokens on a link it does not own state for, which on a shared fabric is a cross-host integrity problem rather than a crash. Only hosts that actually use AF_SMC sockets over RDMA are exposed.

Who can reach it

A remote SMC-R peer reachable over the RoCE/InfiniBand fabric, on a link with a shared v2 receive buffer. No host login is needed, but the target must have SMC-R enabled and a link group established with the peer.

What to do

Take the stable kernel containing commit 0d6f80be8ac5 (or the matching backport for your branch) and reboot each affected node; there is no runtime mitigation inside SMC. If SMC-R is not in use - the common case on GPU nodes - blacklisting the smc module removes the exposure entirely without a reboot, which is the cheaper answer for a fleet you cannot drain quickly.

References

Related entries

• Linux kernel net/smc: out-of-bounds read parsing the v2 extension on every SMC-Rv2 link additionCVE-2026-80986 · Linux kernel net/smc (SMC-Rv2 add-link v2 extension parsing)Unscored
• Linux kernel io_uring/query: unclamped user size lets a local task request ~4 GiB of clear_user zeroingCVE-2026-81009 · Linux kernel io_uring (IORING_REGISTER_QUERY, copy_struct_to_user size cap)Unscored
• Linux kernel io_uring/waitid: canceled task work runs __do_wait() in the wrong task contextCVE-2026-81010 · Linux kernel io_uring waitid (task_work cancellation handling)Unscored
• Linux kernel Intel Speed Select: unvalidated ioctl indices reach MMIO offsets and NULL instancesCVE-2026-89438 · Linux kernel Intel SST driver (isst_if_common ioctl input validation)Unscored
• Linux kernel iommufd: current IOAS rwsem and reference leaked when the unwind path misses itCVE-2026-89446 · Linux kernel iommufd (IOAS rwsem and object reference left held on xa_store failure)Unscored
• Linux kernel iommufd: reference leak on unmap when an internal access is skippedCVE-2026-89447 · Linux kernel iommufd (object reference leak when skipping internal accesses on unmap)Unscored