The issue occurs in the Linux kernel’s SMC (Switch Management Controller) Rv2 handling of LLC messages. The kernel functions smc_llc_rmt_delete_rkey() and smc_llc_save_add_link_rkeys than the 44‑byte smc_llc_msg union, extending past theKEY_V2 message declares 255 rkeys, the function reads rkey entries 9–254 from any remaining data in the shared receive buffer, passing them to smc_rtoken_delete(). If any of these silently match a valid rtoken, the token is removed, potentially corrupting the state of the link. An ADD_LINK on the same link can then install up to 255 rtokens from the wrong bytes, further corrupting the link. The bug could lead to an incorrect deletion of tokens, resource exhaustion, and a denial of service at the network link level. The weakness is an out‑of‑bounds read and data corruption (CWE‑125).

The vulnerability affects all Linux kernel builds that include the net/smc driver prior to the patch. It is not specific to a vendor beyond the generic Linux kernel. No product version list is provided, so any kernel older than the fix could be impacted.

The CVSS v3.1 score is 5.7, giving the vulnerability a moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is a remote peer that can send crafted SMC‑Rv2 LLC messages over a link. If the target device is reachable over a network that permits SMC traffic, the attacker could inject oversized messages, triggering the out‑of‑bounds read and causing the deletion of valid rtokens and eventual denial of service. Exploitation would require control over the link traffic to the affected Linux system.