CVE-2023-52775 – A race condition in the Linux kernel's SMC-R (S... (How to Fix)

📋 TL;DR

A race condition in the Linux kernel's SMC-R (Shared Memory Communications over RDMA) implementation causes data corruption when applications receive SMC protocol decline messages instead of expected application data. This affects systems running Redis or other applications using SMC-R networking with vulnerable Linux kernel versions.

💻 Affected Systems

Products:

Linux Kernel

Versions: Specific vulnerable versions not explicitly stated, but patches target stable kernel branches. Likely affects multiple recent kernel versions with SMC-R support.

Operating Systems: Linux distributions with vulnerable kernel versions

Default Config Vulnerable: ✅ No

Notes: Only affects systems with SMC-R enabled and in use. Redis applications using SMC-R networking are specifically mentioned as affected.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Data corruption leading to application crashes, data loss, or service disruption in Redis or other SMC-R applications.

🟠

Likely Case

Application errors and data corruption in Redis benchmarks and similar network-intensive applications using SMC-R.

🟢

If Mitigated

Minor performance degradation with proper timeout configuration.

🌐 Internet-Facing: LOW - SMC-R is typically used in internal high-performance computing environments, not internet-facing services.

🏢 Internal Only: MEDIUM - Affects internal Redis clusters and high-performance computing applications using SMC-R networking.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Exploitation requires specific timing conditions and SMC-R usage. Discovered during Redis benchmark testing, not through malicious exploitation.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Patches available in stable kernel branches via provided git commits

Vendor Advisory: https://git.kernel.org/stable/c/5ada292b5c504720a0acef8cae9acc62a694d19c

Restart Required: Yes

Instructions:

1. Apply kernel patches from provided git commits
2. Recompile kernel if using custom build
3. Reboot system to load patched kernel
4. For distribution kernels, update to latest patched version

🔧 Temporary Workarounds

Disable SMC-R

linux

Disable SMC-R networking to avoid the vulnerability

echo 0 > /proc/sys/net/smc/smc_r_enabled

Use TCP fallback only

linux

Configure applications to use TCP instead of SMC-R

🧯 If You Can't Patch

Disable SMC-R networking on affected systems
Use TCP networking for Redis and other affected applications instead of SMC-R

🔍 How to Verify

Check if Vulnerable:

Check if SMC-R is enabled and kernel version is unpatched: cat /proc/sys/net/smc/smc_r_enabled && uname -r

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version includes patches and test Redis/SMC-R applications for data corruption

📡 Detection & Monitoring

Log Indicators:

Redis protocol errors mentioning '\xe2' as reply type byte
Application errors indicating data corruption

Network Indicators:

SMC DECLINE messages in network traffic
Unexpected SMC protocol messages in application data streams

SIEM Query:

Search for Redis error logs containing 'Protocol error, got "\\xe2" as reply type byte' or similar corruption indicators

📊 Metadata

CVE ID: CVE-2023-52775

CVSS v3 Score: 7.8 (HIGH)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE: CWE-787

Published: May 21, 2024

Last Updated: September 23, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-52775, you might also want to check these: