CVE-2026-53274: net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS
In the Linux kernel, the following vulnerability has been resolved:
net/smc: fix sleep-inside-lock in smcsetsockopt() causing local DoS
A logic flaw in smcsetsockopt() allows a local unprivileged user to cause a Denial of Service (DoS) by holding the socket lock indefinitely.
The function smcsetsockopt() calls copyfromsockptr() while holding locksock(sk). By passing a userfaultfd-monitored memory page (or FUSE-backed memory on systems where unprivileged userfaultfd is disabled) as the optval, an attacker can halt execution during the copy operation, keeping the lock held.
Combined with asynchronous tear-down operations like shutdown(), this exhausts the kernel wq (kworkers) and triggers the hung task watchdog.
[ 240.123456] INFO: task kworker/u8:2 blocked for more than 120 seconds. [ 240.123489] Call Trace: [ 240.123501] smcshutdown+... [ 240.123512] locksocknested+...
This patch moves the user-space copy outside the locksock() critical section to prevent the issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Configuration
Apply the patch for “net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS” so that the user-space copy (copy_from_sockptr()) is performed outside the lock_sock() critical section; specifically ensure __smc_setsockopt() no longer calls copy_from_sockptr() while holding lock_sock(sk).
Linux kernel (net/smc) sleep-inside-lock in __smc_setsockopt() = fixed by moving user-space copy outside lock_sock() critical section
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53274?
CVE-2026-53274 has a risk rating of 28, indicating a notable potential for impact.
How do I fix CVE-2026-53274?
To fix CVE-2026-53274, update to the latest version of the Linux kernel where the vulnerability has been patched.
What type of vulnerability is CVE-2026-53274?
CVE-2026-53274 is a local Denial of Service (DoS) vulnerability in the Linux kernel's socket option handling.
Who is affected by CVE-2026-53274?
CVE-2026-53274 affects systems running unpatched versions of the Linux kernel that utilize the socket management subsystem.
What is the impact of CVE-2026-53274?
The impact of CVE-2026-53274 is a Denial of Service, allowing local unprivileged users to potentially disrupt system operations.