Re: [PATCH net v4 0/3] net/smc: bound wire-controlled CDC cursors against the local buffers

[Jakub Kicinski]

On Sun, 05 Jul 2026 02:54:04 -0500 Bryam Vargas via B4 Relay wrote:
> A peer's CDC producer/consumer cursors are copied from the wire and used,
> without an upper bound against the local buffers, as (a) a raw index into the
> RMB on the urgent path, (b) the receive length in smc_rx_recvmsg(), and (c) the
> send length in smc_tx_sendmsg() on the SMC-D DMB-merge path. A malicious or
> buggy peer can forge a cursor so each runs past the relevant buffer: an
> out-of-bounds read of adjacent kernel memory (disclosed to the peer) on the
> receive/urgent side, and, on the send side, an out-of-bounds write whose
> length the peer controls and whose overflowing bytes are the local sender's
> own outbound data.

The netdev patch queue has overflown.
If these patches are still relevant you'll have to repost them.