The Linux kernel vulnerability (CVE-2026-80986) concerns the net/smc subsystem's handling of SMC-Rv2 LLC messages. Specifically, when a device's link has max_recv_sge set to 1, the function smc_llc_save_add_link_rkeys reads beyond the allocated 72-byte buffer by accessing the extension structure at an offset that exceeds the buffer size. This out-of-bounds read triggers a KASAN slab-out-of-bounds error, indicating potential kernel memory corruption during every SMC-Rv2 link addition. The vulnerability was identified and resolved by bounding the peer rkey counts in the SMC-Rv2 LLC messages.

This vulnerability can cause kernel memory corruption due to out-of-bounds reads in the net/smc subsystem during SMC-Rv2 link additions. Such corruption may lead to system instability or crashes. There is no indication of active exploitation in the wild or direct remote exploitation vectors provided in the data.

A fix for this vulnerability has been implemented in the Linux kernel by bounding the peer rkey counts in SMC-Rv2 LLC messages. Users should apply the official kernel updates that include this fix. Since no vendor advisory or patch links are provided, check the Linux kernel official repositories or distribution updates for the patched versions. Patch status is not yet confirmed in the provided data — verify with vendor advisories for current remediation guidance.