CVE-2025-39726

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:NAttack vector, network

Every path into `ism_cmd()` is driven by the SMC protocol stack — a remote TCP peer connecting to an SMC-enabled listener causes `smc_listen_work` to issue ISM QUERY_RGID/ADD_VLAN_ID/REG_DMB commands using values from the peer's CLC Proposal, and closing the connection issues SIGNAL_IEQ/UNREG_DMB/DEL_VLAN_ID from the unserialized lgr-free work. The attacker never needs local access.

AC:LAttack complexity, low

The attacker controls both sides of the race by churning concurrent SMC-D connection setups and teardowns, which execute `ism_cmd()` in parallel on different CPUs (setup under `smc_*_lgr_pending`, teardown under no serialization at all). The commit confirms ordinary workloads already hit this "after a while," so deliberate hammering is reliable.

PR:NPrivileges required, none

The SMC CLC handshake has no authentication and `af_smc.c` contains no capability checks, so `smc_ism_cantalk()` reaches `ism_cmd()` with peer-supplied GID/CHID before any credential is ever presented. Locally the equivalent path needs only an unprivileged AF_SMC socket or `TCP_ULP=smc`.

UI:NUser interaction, none

Triggering requires only that the attacker open and close connections; no action by any local user or administrator is needed. The victim host merely has to have an ISM device and SMC-D in use, which is configuration, not interaction.

S:UScope, unchanged

The corrupted commands and misrouted DMB registrations affect resources managed by the same kernel/ISM-function security authority, and bad DMA is contained by the zPCI translation hardware. No hypervisor, LPAR, or IOMMU boundary is escaped.

C:HConfidentiality impact, high

A response read back for the wrong command makes `ism_register_dmb()` store another command's `dmb_tok`, and that token is advertised to the remote peer in the CLC message, so the local socket ends up reading a different connection's DMB contents — cross-connection, cross-user, cross-LPAR payload disclosure. Corrupted `REG_DMB.rgid` similarly exposes a buffer to an unintended remote GID.

I:HIntegrity impact, high

With a misassigned DMB token the remote peer's ISM move writes application data directly into a different connection's receive buffer, and a corrupted `UNREG_DMB.dmb_tok` unregisters the wrong DMB in firmware while the driver's view diverges. The maintainer states commands may be partially overwritten or executed twice with outputs misinterpreted, and declines to bound the consequences.

A:HAvailability impact, high

Command corruption puts the ISM PCI function into error state (PEC 2/3A), breaking every SMC-D connection on it, and the ISM driver implements no error recovery so the device is permanently excluded from future connections until manual intervention. This is a persistent denial of service affecting all users of the adapter.