Linux kernel net/smc: out-of-bounds read parsing the v2 extension on every SMC-Rv2 link addition

Impact

On an RDMA device that reports max_recv_sge == 1 there is no shared v2 receive buffer, so smc_llc_save_add_link_rkeys() takes the v2 extension at 44 bytes past the inline message inside a 72-byte allocation - the num_rkeys field at offset 94 is already past the end of the object. KASAN shows the slab-out-of-bounds read firing on every SMC-Rv2 link addition regardless of what the peer sends, and the rkey count read out of adjacent heap then drives how many rtokens are installed. The practical result is heap data read into RDMA rkey state on link setup, with the attendant risk of a panic under KASAN or hardened allocators. This is a distinct code path from CVE-2026-80985 and has its own fix; a node can be exposed to one and not the other depending on the HCA.

Who can reach it

Triggered locally by any SMC-Rv2 link addition on a host whose RDMA device has max_recv_sge == 1 - no peer action is required beyond establishing the link, and no authentication to the host is involved.

What to do

Update to the stable kernel carrying commit 2d1e7c5aaa33 (or your branch's backport) and reboot the node. If SMC is not used on the fleet, unloading or blacklisting the smc module avoids the path without a maintenance window.

References

Related entries

• Linux kernel io_uring/query: unclamped user size lets a local task request ~4 GiB of clear_user zeroingCVE-2026-81009 · Linux kernel io_uring (IORING_REGISTER_QUERY, copy_struct_to_user size cap)Unscored
• Linux kernel io_uring/waitid: canceled task work runs __do_wait() in the wrong task contextCVE-2026-81010 · Linux kernel io_uring waitid (task_work cancellation handling)Unscored
• Linux kernel Intel Speed Select: unvalidated ioctl indices reach MMIO offsets and NULL instancesCVE-2026-89438 · Linux kernel Intel SST driver (isst_if_common ioctl input validation)Unscored
• Linux kernel iommufd: current IOAS rwsem and reference leaked when the unwind path misses itCVE-2026-89446 · Linux kernel iommufd (IOAS rwsem and object reference left held on xa_store failure)Unscored
• Linux kernel iommufd: reference leak on unmap when an internal access is skippedCVE-2026-89447 · Linux kernel iommufd (object reference leak when skipping internal accesses on unmap)Unscored
• Linux kernel VT-d: ACS not requested under tboot, leaving peer-to-peer DMA isolation offCVE-2026-89448 · Linux kernel iommu/vt-d (ACS request when tboot forces the IOMMU on)Unscored