CVE-2024-49568

What it actually does

Improper input validation in net/smc allows untrusted v2_ext_offset, eid_cnt, and ism_gid_cnt fields in proposal messages to trigger out-of-bounds memory access and kernel crash.

Why it matters to the business

Remote attackers can trigger denial-of-service crashes on Linux systems using SMC, causing service outages and requiring manual restarts or reboots until systems are updated.

How an attack unfolds

An attacker acting as an SMC client sends a crafted proposal message containing an oversized v2_ext_offset value; the server processes the message without bounds checks, dereferences an invalid address, and panics the kernel.

How to fix it

Upgrade the Linux kernel to commit 295a92e3df32e72aff0f4bc25c310e349d07ffbf or later stable releases that include the input validation checks for proposal message fields.

How to confirm the fix worked

Confirm the running kernel contains commit 295a92e3df32e72aff0f4bc25c310e349d07ffbf and test that SMC proposal messages with out-of-range field values are rejected without causing a crash.

Typical attack path

1. Establish network reachability to a target Linux system configured for SMC
2. Send a malicious SMC proposal message with manipulated v2_ext_offset/eid_cnt/ism_gid_cnt fields
3. Trigger kernel memory access violation and system crash

How to detect it

Review kernel logs for SMC proposal processing panics or oops entries containing references to v2_ext_offset or net/smc; no persistent artifacts remain after reboot.

What your security team should do

• Prioritize kernel upgrades to the fixed commit on all systems exposing SMC
• Monitor kernel logs for SMC-related oops or panic messages until patches are applied
• Restrict SMC usage to trusted networks where feasible