CVE-2026-74692

net/smc: fix TOCTOU race between smc_listen_out() and listener close

Published Aug 22, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

net/smc: fix TOCTOU race between smc_listen_out() and listener close

smc_listen_out() reads lsmc->sk.sk_state without the listener lock,
then acquires lock_sock_nested() only after the check passes. This
opens a window where smc_close_active() can transition the listener
to SMC_CLOSED, call smc_close_cleanup_listen() to drain the accept
queue, and release the lock, all between the lockless read and the
delayed lock acquisition:

smc_listen_work (smc_hs_wq) smc_close_active()
------------------------------- -------------------------
release_sock(child)
if (sk_state == SMC_LISTEN) TRUE
lock_sock(listener)
sk_state = SMC_CLOSED
smc_close_cleanup_listen()
release_sock(listener)
flush_work(tcp_listen_work)
lock_sock_nested(listener)
smc_accept_enqueue(listener, child) /* child enqueued on dead listener */

smc_close_active() flushes only tcp_listen_work. Work items already
dispatched onto smc_hs_wq for the CLC handshake continue running
unguarded. smc_accept_enqueue() takes a sock_hold() on the child that
is never released, so the child smc_sock, its clcsock, and the
reference all leak. A remote peer that opens TCP connections while the
server calls close() can exhaust kernel memory.

Move lock_sock_nested() to before the sk_state check so that the test
and the enqueue are atomic under the listener lock.

Analysis

Technical impact

A time‑of‑check to time‑of‑use race was detected in the Linux kernel’s SMC networking module. The race allows a listener to transition to the closed state while a new connection is enqueued, resulting in a memory leak of the child socket. The attacker can exhaust kernel memory, leading to a denial of service. This is a classic race condition flaw.

Affected Systems

All Linux kernel releases that include the SMC networking protocol and have the SMC module enabled before the bug‑fix commit are affected. No specific kernel version ranges are listed; any kernel with the SMC module enabled prior to the change is vulnerable.

Risk and Exploitability

The CVSS score of 7.5 indicates high severity, but the EPSS score is less than 1%, showing a low but non‑zero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a remote peer that can time its connection attempts with a server’s close operation on an SMC listener, exploiting the window between the lockless state check and the delayed lock acquisition to cause a memory leak. Exploitation would require concurrent close and connect actions, but the impact is kernel OOM and service interruption.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9`	affected	< 53c7938d8bcfde3296ec1a347ba2a9393c1fdcfa
`fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9`	affected	< feb71634bb1abab3e8fb5cde874b27001cc1282e
`fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9`	affected	< 01865e1ddb126b25ac9eba5cdd7ec49e11183a64
`fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9`	affected	< 00f89433777236ced4771211047fb5d4cd581cea
`fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9`	affected	< 78e5ebcd1c10ed7c8bda0a99e0abd5b62da86d67
`fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9`	affected	< ff5bcd804b5bc5c64736b7d318c20e12ea9506b8
`fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9`	affected	< 185a4caeecabc150106deda1da170b09f2ad803f
`d1d004585b40c212b338fc8a40cbaaf230ea4703`	affected	—
`4.19.299`	affected	< 4.20

Linux

affected

Version	Status	Constraints
`5.1`	affected	—
`0`	unaffected	< 5.1
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.152`	unaffected	≤ 6.6.*
`6.12.104`	unaffected	≤ 6.12.*
`6.18.45`	unaffected	≤ 6.18.*
`7.1.9`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9,53c7938d8bcfde3296ec1a347ba2a9393c1fdcfa]`	affected	code_commit	—
`[fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9,feb71634bb1abab3e8fb5cde874b27001cc1282e]`	affected	code_commit	—
`[fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9,01865e1ddb126b25ac9eba5cdd7ec49e11183a64]`	affected	code_commit	—
`[fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9,00f89433777236ced4771211047fb5d4cd581cea]`	affected	code_commit	—
`[fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9,78e5ebcd1c10ed7c8bda0a99e0abd5b62da86d67]`	affected	code_commit	—
`[fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9,ff5bcd804b5bc5c64736b7d318c20e12ea9506b8]`	affected	code_commit	—
`[fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9,185a4caeecabc150106deda1da170b09f2ad803f]`	affected	code_commit	—
`d1d004585b40c212b338fc8a40cbaaf230ea4703`	affected	code_commit	—
`[4.19.299,4.20)`	affected	semver	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`5.1`	affected	generic	—
`[0,5.1)`	unaffected	semver	—
`[5.15.216,5.15.*]`	unaffected	semver	—
`[6.1.183,6.1.*]`	unaffected	semver	—
`[6.6.152,6.6.*]`	unaffected	semver	—
`[6.12.104,6.12.*]`	unaffected	semver	—
`[6.18.45,6.18.*]`	unaffected	semver	—
`[7.1.9,7.1.*]`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest Linux kernel that incorporates the race‑condition fix for the SMC module.
Reboot the affected systems to load the patched kernel.
If the patch is not immediately available, restrict or disable the SMC networking interface on any interfaces that are reachable from untrusted networks and monitor kernel memory usage for abnormal growth.

Generated by OpenCVE AI on August 25, 2026 at 16:27 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update
Debian DLA	DLA-4788-1	linux-6.12 security update
Debian DSA	DSA-6466-1	linux security update
Ubuntu USN	USN-8875-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8877-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8878-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8879-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8875-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.490% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://git.kernel.org/stable/c/00f89433777236ced4771211047fb5d4cd581cea
https://git.kernel.org/stable/c/01865e1ddb126b25ac9eba5cdd7ec49e11183a64
https://git.kernel.org/stable/c/185a4caeecabc150106deda1da170b09f2ad803f
https://git.kernel.org/stable/c/53c7938d8bcfde3296ec1a347ba2a9393c1fdcfa
https://git.kernel.org/stable/c/78e5ebcd1c10ed7c8bda0a99e0abd5b62da86d67
https://git.kernel.org/stable/c/feb71634bb1abab3e8fb5cde874b27001cc1282e
https://git.kernel.org/stable/c/ff5bcd804b5bc5c64736b7d318c20e12ea9506b8
https://lore.kernel.org/linux-cve-announce/2026082234-CVE-2026-74692-bf74@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74692
https://www.cve.org/CVERecord?id=CVE-2026-74692

History

Oct 16, 2026 8:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Aug 25, 2026 3:45 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-362 CWE-789

Aug 25, 2026 12:15 PM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-367
References		https://lore.kernel.org/linux-cve-announce/2026082234-CVE-2026-74692-bf74@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74692 https://www.cve.org/CVERecord?id=CVE-2026-74692
Metrics	threat_severity `None`	threat_severity `Moderate`

Aug 25, 2026 11:00 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-362 CWE-789

Aug 25, 2026 9:00 AM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses	CWE-362

Aug 25, 2026 6:00 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`

Aug 22, 2026 5:45 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-362

Aug 22, 2026 3:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net/smc: fix TOCTOU race between smc_listen_out() and listener close smc_listen_out() reads lsmc->sk.sk_state without the listener lock, then acquires lock_sock_nested() only after the check passes. This opens a window where smc_close_active() can transition the listener to SMC_CLOSED, call smc_close_cleanup_listen() to drain the accept queue, and release the lock, all between the lockless read and the delayed lock acquisition: smc_listen_work (smc_hs_wq) smc_close_active() ------------------------------- ------------------------- release_sock(child) if (sk_state == SMC_LISTEN) TRUE lock_sock(listener) sk_state = SMC_CLOSED smc_close_cleanup_listen() release_sock(listener) flush_work(tcp_listen_work) lock_sock_nested(listener) smc_accept_enqueue(listener, child) /* child enqueued on dead listener */ smc_close_active() flushes only tcp_listen_work. Work items already dispatched onto smc_hs_wq for the CLC handshake continue running unguarded. smc_accept_enqueue() takes a sock_hold() on the child that is never released, so the child smc_sock, its clcsock, and the reference all leak. A remote peer that opens TCP connections while the server calls close() can exhaust kernel memory. Move lock_sock_nested() to before the sk_state check so that the test and the enqueue are atomic under the listener lock.
Title		net/smc: fix TOCTOU race between smc_listen_out() and listener close
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/00f89433777236ced4771211047fb5d4cd581cea https://git.kernel.org/stable/c/01865e1ddb126b25ac9eba5cdd7ec49e11183a64 https://git.kernel.org/stable/c/185a4caeecabc150106deda1da170b09f2ad803f https://git.kernel.org/stable/c/53c7938d8bcfde3296ec1a347ba2a9393c1fdcfa https://git.kernel.org/stable/c/78e5ebcd1c10ed7c8bda0a99e0abd5b62da86d67 https://git.kernel.org/stable/c/feb71634bb1abab3e8fb5cde874b27001cc1282e https://git.kernel.org/stable/c/ff5bcd804b5bc5c64736b7d318c20e12ea9506b8