GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80986 (GCVE-0-2026-80986)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:42 – Updated: 2026-09-13 06:28
VLAI
Title
net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages
Summary
In the Linux kernel, the following vulnerability has been resolved: net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages On a link whose device has max_recv_sge == 1 there is no shared v2 receive buffer, and smc_llc_save_add_link_rkeys() takes the v2 extension from 44 bytes past the start of the queue entry's inline message: ext = (struct smc_llc_msg_add_link_v2_ext *)(llc_msg + SMC_WR_TX_SIZE); The entry is a 72-byte allocation and the extension starts at offset 68, so ext->num_rkeys at offset 94 is already past it. This happens on every SMC-Rv2 link addition, whatever the peer sends: [ 2.490065] BUG: KASAN: slab-out-of-bounds in smc_llc_save_add_link_rkeys+0x333/0x350 [ 2.490431] Read of size 2 at addr ffff8880056406de by task smctest/106 [ 2.490709] [ 2.490792] CPU: 0 UID: 0 PID: 106 Comm: smctest Not tainted 7.2.0-rc5-p1-g77a5d9d9c99f #32 PREEMPT(lazy) [ 2.490795] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 2.490798] Call Trace: [ 2.490803] <TASK> [ 2.490805] dump_stack_lvl+0x53/0x70 [ 2.490810] print_report+0xd0/0x630 [ 2.490828] ? __pfx__raw_spin_lock_irqsave+0x10/0x10 [ 2.490832] ? smc_llc_save_add_link_rkeys+0x333/0x350 [ 2.490834] kasan_report+0xce/0x100 [ 2.490836] ? smc_llc_save_add_link_rkeys+0x333/0x350 [ 2.490837] smc_llc_save_add_link_rkeys+0x333/0x350 [ 2.490839] ? smcr_buf_map_lgr+0x1bf/0x2b0 [ 2.490844] smc_llc_cli_add_link+0xca7/0x1e80 [ 2.490848] ? smc_llc_wait+0x355/0x810 [ 2.490850] ? __pfx_smc_llc_wait+0x10/0x10 [ 2.490851] ? __pfx_smc_llc_cli_add_link+0x10/0x10 [ 2.490853] ? __pfx_autoremove_wake_function+0x10/0x10 [ 2.490863] __smc_connect+0x3f5c/0x4980 [ 2.490873] ? __pfx_kernel_connect+0x10/0x10 [ 2.490888] ? __pfx___smc_connect+0x10/0x10 [ 2.490891] ? release_sock+0x148/0x1d0 [ 2.490894] smc_connect+0x42c/0x580 [ 2.490896] __sys_connect+0xfc/0x130 [ 2.490898] ? __pfx___sys_connect+0x10/0x10 [ 2.490900] ? handle_mm_fault+0x1a1/0x430 [ 2.490908] __x64_sys_connect+0x6d/0xb0 [ 2.490909] ? fpregs_assert_state_consistent+0x56/0xe0 [ 2.490917] do_syscall_64+0xf9/0x540 [ 2.490921] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2.490924] RIP: 0033:0x421bb4 [ 2.490927] Code: ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 80 3d ad 34 09 00 00 74 13 b8 2a 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 4c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 55 [ 2.490929] RSP: 002b:00007ffd473b01a8 EFLAGS: 00000202 ORIG_RAX: 000000000000002a [ 2.490935] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000421bb4 [ 2.490936] RDX: 0000000000000010 RSI: 00007ffd473b01d0 RDI: 0000000000000003 [ 2.490937] RBP: 0000000000003930 R08: 0000000000000004 R09: 0000000000000000 [ 2.490938] R10: 00007ffd473b0f98 R11: 0000000000000202 R12: 0000000000000006 [ 2.490939] R13: 00007ffd473b0f87 R14: 0000000000000003 R15: 00007ffd473b0f90 [ 2.490940] </TASK> [ 2.490941] [ 2.499545] Allocated by task 44: [ 2.499693] kasan_save_stack+0x33/0x60 [ 2.499860] kasan_save_track+0x14/0x30 [ 2.500026] __kasan_kmalloc+0x8f/0xa0 [ 2.500190] __kmalloc_cache_noprof+0x158/0x370 [ 2.500393] smc_llc_enqueue+0x72/0x560 [ 2.500559] smc_wr_rx_tasklet_fn+0x474/0xa80 [ 2.500747] tasklet_action_common+0x20f/0x8a0 [ 2.500945] handle_softirqs+0x18e/0x590 [ 2.501115] do_softirq+0x3b/0x60 [ 2.501266] __local_bh_enable_ip+0x61/0x70 [ 2.501446] __alloc_skb+0x732/0x890 [ 2.501604] rxe_init_packet+0x16b/0x4f0 [ 2.501783] prepare_ack_packet+0xb8/0x830 [ 2.501962] rxe_receiver+0x495/0x96e0 [ 2.502125] do_work+0x144/0x470 [ 2.502269] process_one_work+0x633/0x1030 [ 2.502450] worker_thread+0x45b/0xd10 [ 2.50261 ---truncated---
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 27ef6a9981fe74191849966a6d5e0400a4008ab8 , < 486c699a8cde82c1d9b4f443eeab4ddf86358cb0 (git)
Affected: 27ef6a9981fe74191849966a6d5e0400a4008ab8 , < 5e5d9e6df677d30a2203d257b5fd8b99814fa607 (git)
Affected: 27ef6a9981fe74191849966a6d5e0400a4008ab8 , < 2d1e7c5aaa3326e95e2058457f172ca99a9a4577 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/smc/smc_llc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "486c699a8cde82c1d9b4f443eeab4ddf86358cb0",
              "status": "affected",
              "version": "27ef6a9981fe74191849966a6d5e0400a4008ab8",
              "versionType": "git"
            },
            {
              "lessThan": "5e5d9e6df677d30a2203d257b5fd8b99814fa607",
              "status": "affected",
              "version": "27ef6a9981fe74191849966a6d5e0400a4008ab8",
              "versionType": "git"
            },
            {
              "lessThan": "2d1e7c5aaa3326e95e2058457f172ca99a9a4577",
              "status": "affected",
              "version": "27ef6a9981fe74191849966a6d5e0400a4008ab8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/smc/smc_llc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: bound the peer rkey counts in SMC-Rv2 LLC messages\n\nOn a link whose device has max_recv_sge == 1 there is no shared v2 receive\nbuffer, and smc_llc_save_add_link_rkeys() takes the v2 extension from 44\nbytes past the start of the queue entry\u0027s inline message:\n\n  ext = (struct smc_llc_msg_add_link_v2_ext *)(llc_msg + SMC_WR_TX_SIZE);\n\nThe entry is a 72-byte allocation and the extension starts at offset 68, so\next-\u003enum_rkeys at offset 94 is already past it. This happens on every\nSMC-Rv2 link addition, whatever the peer sends:\n\n  [    2.490065] BUG: KASAN: slab-out-of-bounds in smc_llc_save_add_link_rkeys+0x333/0x350\n  [    2.490431] Read of size 2 at addr ffff8880056406de by task smctest/106\n  [    2.490709]\n  [    2.490792] CPU: 0 UID: 0 PID: 106 Comm: smctest Not tainted 7.2.0-rc5-p1-g77a5d9d9c99f #32 PREEMPT(lazy)\n  [    2.490795] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n  [    2.490798] Call Trace:\n  [    2.490803]  \u003cTASK\u003e\n  [    2.490805]  dump_stack_lvl+0x53/0x70\n  [    2.490810]  print_report+0xd0/0x630\n  [    2.490828]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n  [    2.490832]  ? smc_llc_save_add_link_rkeys+0x333/0x350\n  [    2.490834]  kasan_report+0xce/0x100\n  [    2.490836]  ? smc_llc_save_add_link_rkeys+0x333/0x350\n  [    2.490837]  smc_llc_save_add_link_rkeys+0x333/0x350\n  [    2.490839]  ? smcr_buf_map_lgr+0x1bf/0x2b0\n  [    2.490844]  smc_llc_cli_add_link+0xca7/0x1e80\n  [    2.490848]  ? smc_llc_wait+0x355/0x810\n  [    2.490850]  ? __pfx_smc_llc_wait+0x10/0x10\n  [    2.490851]  ? __pfx_smc_llc_cli_add_link+0x10/0x10\n  [    2.490853]  ? __pfx_autoremove_wake_function+0x10/0x10\n  [    2.490863]  __smc_connect+0x3f5c/0x4980\n  [    2.490873]  ? __pfx_kernel_connect+0x10/0x10\n  [    2.490888]  ? __pfx___smc_connect+0x10/0x10\n  [    2.490891]  ? release_sock+0x148/0x1d0\n  [    2.490894]  smc_connect+0x42c/0x580\n  [    2.490896]  __sys_connect+0xfc/0x130\n  [    2.490898]  ? __pfx___sys_connect+0x10/0x10\n  [    2.490900]  ? handle_mm_fault+0x1a1/0x430\n  [    2.490908]  __x64_sys_connect+0x6d/0xb0\n  [    2.490909]  ? fpregs_assert_state_consistent+0x56/0xe0\n  [    2.490917]  do_syscall_64+0xf9/0x540\n  [    2.490921]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n  [    2.490924] RIP: 0033:0x421bb4\n  [    2.490927] Code: ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 80 3d ad 34 09 00 00 74 13 b8 2a 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 4c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 55\n  [    2.490929] RSP: 002b:00007ffd473b01a8 EFLAGS: 00000202 ORIG_RAX: 000000000000002a\n  [    2.490935] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000421bb4\n  [    2.490936] RDX: 0000000000000010 RSI: 00007ffd473b01d0 RDI: 0000000000000003\n  [    2.490937] RBP: 0000000000003930 R08: 0000000000000004 R09: 0000000000000000\n  [    2.490938] R10: 00007ffd473b0f98 R11: 0000000000000202 R12: 0000000000000006\n  [    2.490939] R13: 00007ffd473b0f87 R14: 0000000000000003 R15: 00007ffd473b0f90\n  [    2.490940]  \u003c/TASK\u003e\n  [    2.490941]\n  [    2.499545] Allocated by task 44:\n  [    2.499693]  kasan_save_stack+0x33/0x60\n  [    2.499860]  kasan_save_track+0x14/0x30\n  [    2.500026]  __kasan_kmalloc+0x8f/0xa0\n  [    2.500190]  __kmalloc_cache_noprof+0x158/0x370\n  [    2.500393]  smc_llc_enqueue+0x72/0x560\n  [    2.500559]  smc_wr_rx_tasklet_fn+0x474/0xa80\n  [    2.500747]  tasklet_action_common+0x20f/0x8a0\n  [    2.500945]  handle_softirqs+0x18e/0x590\n  [    2.501115]  do_softirq+0x3b/0x60\n  [    2.501266]  __local_bh_enable_ip+0x61/0x70\n  [    2.501446]  __alloc_skb+0x732/0x890\n  [    2.501604]  rxe_init_packet+0x16b/0x4f0\n  [    2.501783]  prepare_ack_packet+0xb8/0x830\n  [    2.501962]  rxe_receiver+0x495/0x96e0\n  [    2.502125]  do_work+0x144/0x470\n  [    2.502269]  process_one_work+0x633/0x1030\n  [    2.502450]  worker_thread+0x45b/0xd10\n  [    2.50261\n---truncated---"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The OOB is reached from SMC-Rv2 LLC ADD_LINK and DELETE_RKEY handling on the RDMA RX path (smc_wr_rx_tasklet_fn\u2192smc_llc_rx_handler\u2192smc_llc_enqueue). CLC is plain TCP and SMC-Rv2/RoCEv2 LLC is IP-routable (UDP/4791), so a remote peer that can reach an AF_SMC listener drives the path.\nAC:L - On SMC-Rv2 links with max_recv_sge==1 (the supported device class this bug exists for), every ADD_LINK reads past the 72-byte qentry regardless of peer contents, and a DELETE_RKEY_V2 with num_rkeys=255 walks up to 255 rkeys off the object; no race or attacker-uncontrollable layout is required.\nPR:N - SMC authenticates nothing. smc_create()/smc_listen() enforce no capabilities, and smc_listen_work() runs the CLC/LLC handshake after TCP accept before accept() returns to userspace, so an unauthenticated network peer needs only reachability to the listener.\nUI:N - The listen worker is queued automatically from smc_tcp_listen_work() for inbound connections, and DELETE_RKEY is processed in the LLC event worker from RDMA completions; no local user action such as mounting a filesystem or opening a file is required.\nS:U - The slab out-of-bounds read and the resulting writes into the link-group rtoken table stay inside the host kernel (kmalloc qentry, lgr-\u003ertokens) and do not cross a VM, IOMMU, or sandbox boundary.\nC:H - smc_llc_save_add_link_rkeys() reads ext-\u003enum_rkeys 22 bytes past the 72-byte qentry and then walks up to 255 16-byte rt[] entries of adjacent heap; smc_llc_rmt_delete_rkey() similarly out-of-bounds-reads rkey[9..254]. Per kernel CNA guidance a large heap out-of-bounds read is High.\nI:H - Those out-of-bounds bytes are passed to smc_rtoken_set() (writes rkey/dma_addr into lgr-\u003ertokens) and smc_rtoken_delete() (clears matching rtokens). Adjacent kmalloc-96 spray lets a peer influence the written values, corrupting RDMA targeting used by ib_post_send.\nA:H - KASAN reports slab-out-of-bounds in smc_llc_save_add_link_rkeys on every affected ADD_LINK; a multi-kilobyte walk off a 72-byte object can oops when it hits an unmapped page, and a remote peer can repeat the handshake or DELETE_RKEY at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:28:51.402Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/486c699a8cde82c1d9b4f443eeab4ddf86358cb0"
        },
        {
          "url": "https://git.kernel.org/stable/c/5e5d9e6df677d30a2203d257b5fd8b99814fa607"
        },
        {
          "url": "https://git.kernel.org/stable/c/2d1e7c5aaa3326e95e2058457f172ca99a9a4577"
        }
      ],
      "title": "net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80986",
    "datePublished": "2026-09-11T19:42:44.904Z",
    "dateReserved": "2026-08-26T14:34:25.811Z",
    "dateUpdated": "2026-09-13T06:28:51.402Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80986",
      "date": "2026-09-16",
      "epss": "0.00605",
      "percentile": "0.47378"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80986\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:05.180\",\"lastModified\":\"2026-09-13T07:17:05.417\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/smc: bound the peer rkey counts in SMC-Rv2 LLC messages\\n\\nOn a link whose device has max_recv_sge == 1 there is no shared v2 receive\\nbuffer, and smc_llc_save_add_link_rkeys() takes the v2 extension from 44\\nbytes past the start of the queue entry\u0027s inline message:\\n\\n  ext = (struct smc_llc_msg_add_link_v2_ext *)(llc_msg + SMC_WR_TX_SIZE);\\n\\nThe entry is a 72-byte allocation and the extension starts at offset 68, so\\next-\u003enum_rkeys at offset 94 is already past it. This happens on every\\nSMC-Rv2 link addition, whatever the peer sends:\\n\\n  [    2.490065] BUG: KASAN: slab-out-of-bounds in smc_llc_save_add_link_rkeys+0x333/0x350\\n  [    2.490431] Read of size 2 at addr ffff8880056406de by task smctest/106\\n  [    2.490709]\\n  [    2.490792] CPU: 0 UID: 0 PID: 106 Comm: smctest Not tainted 7.2.0-rc5-p1-g77a5d9d9c99f #32 PREEMPT(lazy)\\n  [    2.490795] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\\n  [    2.490798] Call Trace:\\n  [    2.490803]  \u003cTASK\u003e\\n  [    2.490805]  dump_stack_lvl+0x53/0x70\\n  [    2.490810]  print_report+0xd0/0x630\\n  [    2.490828]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\\n  [    2.490832]  ? smc_llc_save_add_link_rkeys+0x333/0x350\\n  [    2.490834]  kasan_report+0xce/0x100\\n  [    2.490836]  ? smc_llc_save_add_link_rkeys+0x333/0x350\\n  [    2.490837]  smc_llc_save_add_link_rkeys+0x333/0x350\\n  [    2.490839]  ? smcr_buf_map_lgr+0x1bf/0x2b0\\n  [    2.490844]  smc_llc_cli_add_link+0xca7/0x1e80\\n  [    2.490848]  ? smc_llc_wait+0x355/0x810\\n  [    2.490850]  ? __pfx_smc_llc_wait+0x10/0x10\\n  [    2.490851]  ? __pfx_smc_llc_cli_add_link+0x10/0x10\\n  [    2.490853]  ? __pfx_autoremove_wake_function+0x10/0x10\\n  [    2.490863]  __smc_connect+0x3f5c/0x4980\\n  [    2.490873]  ? __pfx_kernel_connect+0x10/0x10\\n  [    2.490888]  ? __pfx___smc_connect+0x10/0x10\\n  [    2.490891]  ? release_sock+0x148/0x1d0\\n  [    2.490894]  smc_connect+0x42c/0x580\\n  [    2.490896]  __sys_connect+0xfc/0x130\\n  [    2.490898]  ? __pfx___sys_connect+0x10/0x10\\n  [    2.490900]  ? handle_mm_fault+0x1a1/0x430\\n  [    2.490908]  __x64_sys_connect+0x6d/0xb0\\n  [    2.490909]  ? fpregs_assert_state_consistent+0x56/0xe0\\n  [    2.490917]  do_syscall_64+0xf9/0x540\\n  [    2.490921]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\\n  [    2.490924] RIP: 0033:0x421bb4\\n  [    2.490927] Code: ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 80 3d ad 34 09 00 00 74 13 b8 2a 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 4c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 55\\n  [    2.490929] RSP: 002b:00007ffd473b01a8 EFLAGS: 00000202 ORIG_RAX: 000000000000002a\\n  [    2.490935] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000421bb4\\n  [    2.490936] RDX: 0000000000000010 RSI: 00007ffd473b01d0 RDI: 0000000000000003\\n  [    2.490937] RBP: 0000000000003930 R08: 0000000000000004 R09: 0000000000000000\\n  [    2.490938] R10: 00007ffd473b0f98 R11: 0000000000000202 R12: 0000000000000006\\n  [    2.490939] R13: 00007ffd473b0f87 R14: 0000000000000003 R15: 00007ffd473b0f90\\n  [    2.490940]  \u003c/TASK\u003e\\n  [    2.490941]\\n  [    2.499545] Allocated by task 44:\\n  [    2.499693]  kasan_save_stack+0x33/0x60\\n  [    2.499860]  kasan_save_track+0x14/0x30\\n  [    2.500026]  __kasan_kmalloc+0x8f/0xa0\\n  [    2.500190]  __kmalloc_cache_noprof+0x158/0x370\\n  [    2.500393]  smc_llc_enqueue+0x72/0x560\\n  [    2.500559]  smc_wr_rx_tasklet_fn+0x474/0xa80\\n  [    2.500747]  tasklet_action_common+0x20f/0x8a0\\n  [    2.500945]  handle_softirqs+0x18e/0x590\\n  [    2.501115]  do_softirq+0x3b/0x60\\n  [    2.501266]  __local_bh_enable_ip+0x61/0x70\\n  [    2.501446]  __alloc_skb+0x732/0x890\\n  [    2.501604]  rxe_init_packet+0x16b/0x4f0\\n  [    2.501783]  prepare_ack_packet+0xb8/0x830\\n  [    2.501962]  rxe_receiver+0x495/0x96e0\\n  [    2.502125]  do_work+0x144/0x470\\n  [    2.502269]  process_one_work+0x633/0x1030\\n  [    2.502450]  worker_thread+0x45b/0xd10\\n  [    2.50261\\n---truncated---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/smc/smc_llc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"27ef6a9981fe74191849966a6d5e0400a4008ab8\",\"lessThan\":\"486c699a8cde82c1d9b4f443eeab4ddf86358cb0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"27ef6a9981fe74191849966a6d5e0400a4008ab8\",\"lessThan\":\"5e5d9e6df677d30a2203d257b5fd8b99814fa607\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"27ef6a9981fe74191849966a6d5e0400a4008ab8\",\"lessThan\":\"2d1e7c5aaa3326e95e2058457f172ca99a9a4577\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/smc/smc_llc.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2d1e7c5aaa3326e95e2058457f172ca99a9a4577\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/486c699a8cde82c1d9b4f443eeab4ddf86358cb0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5e5d9e6df677d30a2203d257b5fd8b99814fa607\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T19:49:18+00:00",
      "cve": "CVE-2026-80986",
      "id": "CVE-2026-80986",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_affected": "185",
      "product_status:known_not_affected": "91",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80986.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T01:04:40Z",
      "cve": "CVE-2026-80986",
      "id": "CVE-2026-80986",
      "initial_release_date": "2026-09-12T16:36:14Z",
      "product_status:known_not_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80986",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80986.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.