A time‑of‑check to time‑of‑use race was detected in the Linux kernel’s SMC networking module. The race allows a listener to transition to the closed state while a new connection is enqueued, resulting in a memory leak of the child socket. The attacker can exhaust kernel memory, leading to a denial of service. This is a classic race condition flaw.

All Linux kernel releases that include the SMC networking protocol and have the SMC module enabled before the bug‑fix commit are affected. No specific kernel version ranges are listed; any kernel with the SMC module enabled prior to the change is vulnerable.

The CVSS score of 7.5 indicates high severity, but the EPSS score is less than 1%, showing a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote peer that can time its connection attempts with a server’s close operation on an SMC listener, exploiting the window between the lockless state check and the delayed lock acquisition to cause a memory leak. Exploitation would require concurrent close and connect actions, but the impact is kernel OOM and service interruption.