CVE-2026-80986

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 7.2.6-1.1

Description An out-of-bounds access issue exists in the net/smc component during the handling of SMC-Rv2 LLC messages. On links where the device has max recv sge set to 1, there is no shared v2 receive buffer. In this scenario, the smc llc save add link rkeys() function attempts to access a v2 extension at an offset that exceeds the 72-byte allocation of the queue entry's inline message. Specifically, the num rkeys variable at offset 94 is accessed outside the allocated memory boundary, leading to a slab-out-of-bounds read during every SMC-Rv2 link addition.

Recommendations Update the Linux kernel to version 7.2.6-1.1 or later. As a temporary mitigation, restrict the use of the smc llc save add link rkeys() function if possible.