CVE-2026-80985

A flaw was found in the Linux kernel's Server Message Block over Remote Direct Memory Access SMC-Rv2 protocol implementation. The smcllcrmtdeleterkey and smcllcsaveaddlinkrkeys functions incorrectly handle oversized LLC messages, reading beyond the intended message boundaries. This can lead to th...

CVE-2026-80986

A flaw was found in the Linux kernel's SMC-Rv2 network component. A remote attacker could exploit this vulnerability by sending a specially crafted message during an SMC-Rv2 link addition. This can lead to a slab-out-of-bounds write, potentially causing a system crash and resulting in a denial of...

CVE-2026-80985

In the Linux kernel, the following vulnerability has been resolved: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry smcllcrmtdeleterkey and smcllcsaveaddlinkrkeys read the part of a v2 message that does not fit into the 44-byte union smcllcmsg, and both bound themselves by the si...

CVE-2026-80986

In the Linux kernel, the following vulnerability has been resolved: net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages On a link whose device has maxrecvsge == 1 there is no shared v2 receive buffer, and smcllcsaveaddlinkrkeys takes the v2 extension from 44 bytes past the start of the...

CVE-2026-80985 net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry

In the Linux kernel, the following vulnerability has been resolved: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry smcllcrmtdeleterkey and smcllcsaveaddlinkrkeys read the part of a v2 message that does not fit into the 44-byte union smcllcmsg, and both bound themselves by the si...

CVE-2026-80986

CVE-2026-80986 is a slab-out-of-bounds read in the Linux kernel's net/smc subsystem, specifically in smc_llc_save_add_link_rkeys(). On links whose device has max_recv_sge == 1, no shared v2 receive buffer exists, yet the function unconditionally reads the v2 extension starting at offset 68 of a 7...

CVE-2026-80986 net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages

In the Linux kernel, the following vulnerability has been resolved: net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages On a link whose device has maxrecvsge == 1 there is no shared v2 receive buffer, and smcllcsaveaddlinkrkeys takes the v2 extension from 44 bytes past the start of the...

CVE-2026-80985

This vulnerability affects the Linux kernel 's SMC (Shared Memory Communication) subsystem, specifically SMC-Rv2 LLC message handling. The functions smc_llc_rmt_delete_rkey() and smc_llc_save_add_link_rkeys() read the portion of a v2 message exceeding the 44-byte smc_llc_msg union, but bound thei...

EUVD-2026-76309

In the Linux kernel, the following vulnerability has been resolved: net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages On a link whose device has maxrecvsge == 1 there is no shared v2 receive buffer, and smcllcsaveaddlinkrkeys takes the v2 extension from 44 bytes past the start of the...

EUVD-2026-76308

In the Linux kernel, the following vulnerability has been resolved: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry smcllcrmtdeleterkey and smcllcsaveaddlinkrkeys read the part of a v2 message that does not fit into the 44-byte union smcllcmsg, and both bound themselves by the si...

PT-2026-90116

In the Linux kernel, the following vulnerability has been resolved: net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages On a link whose device has max recv sge == 1 there is no shared v2 receive buffer, and smc llc save add link rkeys takes the v2 extension from 44 bytes past the start of...

PT-2026-90115

In the Linux kernel, the following vulnerability has been resolved: net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry smc llc rmt delete rkey and smc llc save add link rkeys read the part of a v2 message that does not fit into the 44-byte union smc llc msg, and both bound themselve...