The Linux kernel vulnerability CVE-2026-80985 concerns the net/smc subsystem handling of SMC-Rv2 LLC messages. Specifically, the functions smc_llc_rmt_delete_rkey() and smc_llc_save_add_link_rkeys() read parts of a version 2 message beyond the 44-byte union smc_llc_msg buffer, bounded by the buffer size rather than the actual message size. This allowed a DELETE_RKEY_V2 message declaring 255 rkeys to access and delete rtokens beyond the intended range, potentially deleting a registered rtoken erroneously. The patch copies the tail of the message into the queue entry with the correct length and restricts processing to the inline rkeys within the union, preventing out-of-bounds access and unintended rtoken deletion. The previous patch's bound on links without a shared v2 receive buffer is no longer necessary.

The vulnerability could lead to unintended deletion of registered rtokens due to out-of-bounds reading of oversized SMC-Rv2 LLC messages. This could affect the reliability and correctness of the SMC-Rv2 link management in the Linux kernel. No information about exploitation in the wild is available.

A fix has been implemented in the Linux kernel to correctly handle oversized SMC-Rv2 LLC messages by copying the message tail into the queue entry and limiting processing to the actual message length. Users should apply the official kernel update that includes this patch to remediate the vulnerability. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.