CVE-2026-80985

A flaw was found in the Linux kernel's Server Message Block over Remote Direct Memory Access (SMC-Rv2) protocol implementation. The smc_llc_rmt_delete_rkey() and smc_llc_save_add_link_rkeys() functions incorrectly handle oversized LLC messages, reading beyond the intended message boundaries. This can lead to the processing of stale or unintended data from previous messages, potentially resulting in information disclosure or data corruption. A remote attacker could exploit this vulnerability to gain access to sensitive information or cause system instability.

This flaw is rated as having Important impact because a network peer capable of exchanging SMC-R traffic can trigger out-of-bounds reads in the kernel, leading to potential denial of service or unexpected memory access. In standard Red Hat Enterprise Linux deployments, overall exposure is limited because Shared Memory Communications over RDMA requires specialized hardware interfaces and explicit protocol configuration rather than default TCP/IP operations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, prevent the Shared Memory Communications (smc) kernel module from loading on the system:

1. Add a configuration rule in /etc/modprobe.d/ to disable autoloading:

echo "install smc /bin/true" >> /etc/modprobe.d/disable-smc.conf

2. If the module is already loaded, attempt to unload it:

modprobe -r smc

Warning: Disabling this module prevents applications from establishing SMC (SMC-R/SMC-D) connections, which may cause them to fall back to standard TCP or fail if SMC is strictly required. If the module cannot be unloaded because it is currently in use, a full system reboot is necessary to enforce the mitigation.