EUVD-2026-76308
GHSA-439p-4phc-pprq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
AC:H reflects mandatory RDMA infrastructure, SMC-Rv2 link setup, and timing-dependent shared-buffer residue; AV:N retained as SMC negotiation initiates over standard TCP.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry
smc_llc_rmt_delete_rkey() and smc_llc_save_add_link_rkeys() read the part of a v2 message that does not fit into the 44-byte union smc_llc_msg, and both bound themselves by the size of the buffer it landed in, not by what arrived. On a link with a shared v2 receive buffer a 44-byte DELETE_RKEY_V2 declaring 255 rkeys reaches rkey[9..254] in whatever an earlier message left in lgr->wr_rx_buf_v2, and passes each of them to smc_rtoken_delete(). One of those 255 matched a registered rtoken and deleted it. An ADD_LINK on such a link installs up to 255 rtokens from the same bytes.
Copy the tail into the queue entry, so its length is the length of the message that arrived, and declare the rkeys that fit inline as a member of the union instead of reaching them through a cast. The same DELETE_RKEY_V2 now processes the 9 rkeys it carries. The copy is limited to the longest tail the two functions can read, so the peer does not pick the size of the entry.
The bound the previous patch placed on links without a shared v2 receive buffer is no longer needed.
AnalysisAI
Out-of-bounds buffer read in the Linux kernel SMC-Rv2 LLC message handler allows a malicious remote SMC peer to corrupt rtoken state by triggering reads from stale shared receive-buffer data. Specifically, smc_llc_rmt_delete_rkey() and smc_llc_save_add_link_rkeys() process a crafted DELETE_RKEY_V2 or ADD_LINK v2 message declaring up to 255 rkeys, reading the overflow portion from whatever a prior message left in lgr->wr_rx_buf_v2, potentially deleting valid registered memory keys or installing spurious ones. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) the target Linux system has the smc kernel module loaded and SMC-Rv2 is actively negotiated with an RDMA-capable NIC (RoCE or iWARP); (2) a shared v2 receive buffer (lgr->wr_rx_buf_v2) is in use on the link - this is a specific SMC-Rv2 link configuration; (3) a prior v2 LLC message has left residual data in that shared buffer before the crafted message arrives, introducing a timing dependency; (4) the attacker can act as or impersonate a legitimate SMC-Rv2 peer - requiring adjacency to the RDMA fabric or control of an SMC endpoint. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS vector AV:N/AC:L/PR:N overstates practical exploitability. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream fix commits backported to the relevant stable branch: 8d3c1ab82c11d4fadebf817a825fd221b3e197ea, edf30d65e3ac52f886f7d87b1a7449742e79157d, or 0d6f80be8ac5886842640d6526abf3f9a215be75 (all at git.kernel.org/stable). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Immediately assess which systems run Linux with SMC-R protocol enabled (check kernel module status and configuration); identify this within 24 hours to scope exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today