CVE-2026-74692: net/smc: fix TOCTOU race between smc_listen_out() and listener close
In the Linux kernel, the following vulnerability has been resolved:
net/smc: fix TOCTOU race between smclistenout() and listener close
smclistenout() reads lsmc->sk.skstate without the listener lock, then acquires locksocknested() only after the check passes. This opens a window where smccloseactive() can transition the listener to SMCCLOSED, call smcclosecleanuplisten() to drain the accept queue, and release the lock, all between the lockless read and the delayed lock acquisition:
smclistenwork (smchswq) smccloseactive() ------------------------------- ------------------------- releasesock(child) if (skstate == SMCLISTEN) TRUE locksock(listener) skstate = SMCCLOSED smcclosecleanuplisten() releasesock(listener) flushwork(tcplistenwork) locksocknested(listener) smcacceptenqueue(listener, child) / child enqueued on dead listener /
smccloseactive() flushes only tcplistenwork. Work items already dispatched onto smchswq for the CLC handshake continue running unguarded. smcacceptenqueue() takes a sockhold() on the child that is never released, so the child smcsock, its clcsock, and the reference all leak. A remote peer that opens TCP connections while the server calls close() can exhaust kernel memory.
Move locksocknested() to before the skstate check so that the test and the enqueue are atomic under the listener lock.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.152.1-1 - Configuration
Apply the net/smc fix: move lock_sock_nested() before the sk_state check in smc_listen_out() so the state check and accept enqueue are atomic under the listener lock; also ensure that if sk_state transitions to SMC_CLOSED, smc_close_cleanup_listen() is called to drain the accept queue and prevent leaked references.
Linux kernel net/smc smc_listen_out() listener state handling = Call smc_close_cleanup_listen() to drain the accept queue when listener transitions to SMC_CLOSED; avoid lockless read/TOCTOU by moving lock_sock_nested() before the sk_state check so test and enqueue are atomic under the listener lock.
Event History
Frequently Asked Questions
What conditions are needed to trigger the leak?
A TCP connection must have work dispatched to the SMC handshake workqueue while the corresponding SMC listener is being closed. The listener can transition to SMC_CLOSED and have its accept queue drained before the dispatched handshake work later acquires the listener lock and enqueues the child.
What is the practical impact of a successful race?
The child can be enqueued on a dead listener after cleanup has completed. The child socket, its clcsock, and a socket reference can then leak because the reference taken during accept enqueue is never released.
Which systems are exposed based on the available information?
Systems using the Linux kernel SMC networking listener path are implicated. The provided data does not identify affected kernel versions, distributions, or whether the vulnerable path is enabled by default.