CVE-2026-74692: net/smc: fix TOCTOU race between smc_listen_out() and listener close
In the Linux kernel, the following vulnerability has been resolved:
net/smc: fix TOCTOU race between smclistenout() and listener close
smclistenout() reads lsmc->sk.skstate without the listener lock, then acquires locksocknested() only after the check passes. This opens a window where smccloseactive() can transition the listener to SMCCLOSED, call smcclosecleanuplisten() to drain the accept queue, and release the lock, all between the lockless read and the delayed lock acquisition:
smclistenwork (smchswq) smccloseactive() ------------------------------- ------------------------- releasesock(child) if (skstate == SMCLISTEN) TRUE locksock(listener) skstate = SMCCLOSED smcclosecleanuplisten() releasesock(listener) flushwork(tcplistenwork) locksocknested(listener) smcacceptenqueue(listener, child) / child enqueued on dead listener /
smccloseactive() flushes only tcplistenwork. Work items already dispatched onto smchswq for the CLC handshake continue running unguarded. smcacceptenqueue() takes a sockhold() on the child that is never released, so the child smcsock, its clcsock, and the reference all leak. A remote peer that opens TCP connections while the server calls close() can exhaust kernel memory.
Move locksocknested() to before the skstate check so that the test and the enqueue are atomic under the listener lock.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Apply the net/smc fix: move lock_sock_nested() before the sk_state check in smc_listen_out() so the state check and accept enqueue are atomic under the listener lock; also ensure that if sk_state transitions to SMC_CLOSED, smc_close_cleanup_listen() is called to drain the accept queue and prevent leaked references.
Linux kernel net/smc smc_listen_out() listener state handling = Call smc_close_cleanup_listen() to drain the accept queue when listener transitions to SMC_CLOSED; avoid lockless read/TOCTOU by moving lock_sock_nested() before the sk_state check so test and enqueue are atomic under the listener lock.