CVE-2026-74692 Overview
CVE-2026-74692 is a time-of-check time-of-use (TOCTOU) race condition in the Linux kernel's Shared Memory Communications (SMC) subsystem. The flaw resides in smc_listen_out(), which reads lsmc->sk.sk_state without holding the listener lock before calling lock_sock_nested(). A concurrent smc_close_active() call can transition the listener socket to SMC_CLOSED and drain the accept queue during that window. Work items dispatched on smc_hs_wq for the Connection Layer Control (CLC) handshake continue running unguarded, enqueueing child sockets on a closed listener. Each leaked child holds a sock_hold() reference that is never released.
Critical Impact
A remote peer opening TCP connections while the server calls close() can exhaust kernel memory, causing a denial-of-service condition on affected Linux hosts.
Affected Products
- Linux kernel versions containing the vulnerable net/smc listener implementation
- Systems with SMC (Shared Memory Communications) protocol enabled
- Server workloads accepting SMC connections over TCP
Discovery Timeline
- 2026-08-22 - CVE-2026-74692 published to NVD
- 2026-08-25 - Last updated in NVD database
Technical Details for CVE-2026-74692
Vulnerability Analysis
The vulnerability is a race condition [CWE-367] in the Linux kernel SMC protocol handler. The smc_listen_out() function performs a lockless read of the listener socket state, then acquires lock_sock_nested() only after the check passes. Between these two operations, another thread executing smc_close_active() can complete a full close sequence on the listener.
The close path transitions sk_state to SMC_CLOSED, invokes smc_close_cleanup_listen() to drain the accept queue, releases the lock, and flushes tcp_listen_work. However, only tcp_listen_work is flushed. Work items already dispatched to smc_hs_wq for CLC handshake processing continue executing without synchronization.
When the delayed lock acquisition finally completes in the handshake worker, smc_accept_enqueue() places the child socket onto a listener that has already been marked closed. The enqueue path calls sock_hold() on the child, incrementing its reference count. Because the listener is dead and no accept() will ever consume the queue, that reference is never dropped.
Root Cause
The root cause is non-atomic verification of listener state under the socket lock. The state check and enqueue operation are not performed atomically, violating the invariant that only a valid SMC_LISTEN socket may accept new children.
Attack Vector
A remote attacker opens TCP connections to an SMC-enabled server while the server is closing its listening socket. Each successfully raced handshake leaks one smc_sock, its associated clcsock, and the held reference. Sustained connection attempts against a service that periodically closes and reopens listeners can exhaust kernel memory. The vulnerability requires no authentication and is exploitable over the network.
The upstream fix moves lock_sock_nested() before the sk_state check, ensuring the test and the enqueue are atomic under the listener lock. See the Linux Kernel Commit ff5bcd8 for the reference implementation.
Detection Methods for CVE-2026-74692
Indicators of Compromise
- Unexplained growth in kernel slab allocations tied to sock and smc_sock objects
- Repeated inbound TCP connections targeting SMC-enabled listening ports followed by service restarts
- Kernel memory pressure or out-of-memory kills on hosts running SMC workloads
Detection Strategies
- Monitor /proc/slabinfo for anomalous growth in sock_inode_cache and SMC-related slabs
- Correlate socket close operations on SMC listeners with concurrent burst connection attempts from remote peers
- Track kernel version and CONFIG_SMC status across the fleet to enumerate exposed hosts
Monitoring Recommendations
- Alert on sustained kernel memory consumption trends that do not correspond to user workload growth
- Log network flows to SMC service ports and baseline typical connection churn
- Use eBPF probes on smc_accept_enqueue and smc_close_active to detect abnormal concurrency patterns
How to Mitigate CVE-2026-74692
Immediate Actions Required
- Apply the stable kernel updates referenced in the upstream commits as soon as vendor packages are available
- Inventory hosts with CONFIG_SMC=y or the smc module loaded and prioritize patching internet-exposed systems
- Restrict network reachability to SMC service endpoints using host firewalls or network segmentation until patches land
Patch Information
The fix reorders lock acquisition so that lock_sock_nested() is taken before the sk_state check, making the test-and-enqueue sequence atomic. Backports are available across stable trees in the following commits: 00f8943, 01865e1, 185a4ca, 53c7938, 78e5ebc, feb7163, and ff5bcd8.
Workarounds
- Unload the smc module on hosts that do not require SMC connectivity using modprobe -r smc
- Blacklist the smc module via /etc/modprobe.d/ to prevent automatic loading at boot
- Block inbound traffic to SMC-enabled services from untrusted networks at the perimeter
# Disable the SMC module to eliminate exposure
echo "blacklist smc" | sudo tee /etc/modprobe.d/disable-smc.conf
sudo modprobe -r smc 2>/dev/null || true
lsmod | grep -E '^smc\b' && echo "smc still loaded" || echo "smc not loaded"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
