CVE-2026-72018: Linux Kernel Out-of-Bounds Write in SMC-D Loopback Enables Local Root

SMC-D is the Linux kernel's shared memory communications transport. It used to need IBM Z or ISM hardware. The dibs_loopback virtual transport put the same code paths on ordinary x86 hosts. When a peer writes into a direct memory buffer, the loopback path does not check that the offset and length fit inside the allocation.

A local attacker with CAP_NET_ADMIN sets up SMC-D over loopback, intercepts the traffic, and sends an out-of-range offset or an oversized write. The kernel writes past the buffer into adjacent memory. XBOW's proof of concept grooms the heap so a cred structure sits right after the buffer, overwrites it, and gets root. The CVE carries a CVSS score of 7.8.