CVE-2026-80986

A flaw was found in the Linux kernel's SMC-Rv2 network component. A remote attacker could exploit this vulnerability by sending a specially crafted message during an SMC-Rv2 link addition. This can lead to a slab-out-of-bounds write, potentially causing a system crash and resulting in a denial of service.

An out-of-bounds read in the SMC-Rv2 LLC rkey handling path can occur when the device has max_recv_sge is 1 and no shared v2 receive buffer is used. In this case only the inline LLC message is copied into the queue entry, but smc_llc_save_add_link_rkeys can still parse the v2 extension past the copied buffer and smc_llc_rmt_delete_rkey can also iterate rkey entries beyond the buffer it points to. A remote SMC/RDMA peer that can establish or influence an SMC-Rv2 link can trigger the vulnerable parsing path during link addition or rkey deletion, causing a kernel slab out-of-bounds read and likely denial of service through KASAN report or kernel crash. For the CVSS the PR:N is used because the attacker does not need a local account on the victim and only needs network adjacency to the exposed SMC/RDMA fabric. The issue is rated AV:A rather than AV:N because SMC-Rv2 over RDMA is normally limited to local storage or data center networks. Impact is at least denial of service. For paranoid triage, limited confidentiality or integrity impact is kept because kernel heap data is read out of bounds and may influence rkey state, but there is no clear arbitrary write or direct information disclosure primitive.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.