CVE-2026-74692net/smc: fix TOCTOU race between smc_listen_out() and listener close
- 7.5HighCVSS base score
- 0.49%Exploitation in 30 daysEPSS · top 57% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: net/smc: fix TOCTOU race between smc_listen_out() and listener close smc_listen_out() reads lsmc->sk.sk_state without the listener lock, then acquires lock_sock_nested() only after the check passes. This opens a window where smc_close_active() can transition the listener to SMC_CLOSED, call smc_close_cleanup_listen() to drain the accept queue, and release the lock, all between the lockless read and the delayed lock acquisition: smc_listen_work (smc_hs_wq) smc_close_active() ------------------------------- ------------------------- release_sock(child) if (sk_state == SMC_LISTEN) TRUE lock_sock(listener) sk_state = SMC_CLOSED smc_close_cleanup_listen() release_sock(listener) flush_work(tcp_listen_work) lock_sock_nested(listener) smc_accept_enqueue(listener, child) /* child enqueued on dead listener */ smc_close_active() flushes only tcp_listen_work. Work items already dispatched onto smc_hs_wq for the CLC handshake continue running unguarded. smc_accept_enqueue() takes a sock_hold() on the child that is never released, so the child smc_sock, its clcsock, and the reference all leak. A remote peer that opens TCP connections while the server calls close() can exhaust kernel memory. Move lock_sock_nested() to before the sk_state check so that the test and the enqueue are atomic under the listener lock.
Timeline
ID reserved
By Linux
- 7 days later
· 7 days later
Published
- 55 days later
· 55 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| NVDNVD · Received | 3.1 | High7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
- EPSS (exploitation in 30 days)
- 0.49% · top 57% of all CVEs (13 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Affected products
- affected fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9 – < 53c7938d8bcfde3296ec1a347ba2a9393c1fdcfa
- affected fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9 – < feb71634bb1abab3e8fb5cde874b27001cc1282e
- affected fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9 – < 01865e1ddb126b25ac9eba5cdd7ec49e11183a64
- affected fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9 – < 00f89433777236ced4771211047fb5d4cd581cea
- affected fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9 – < 78e5ebcd1c10ed7c8bda0a99e0abd5b62da86d67
- affected fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9 – < ff5bcd804b5bc5c64736b7d318c20e12ea9506b8
- affected fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9 – < 185a4caeecabc150106deda1da170b09f2ad803f
- affected d1d004585b40c212b338fc8a40cbaaf230ea4703
- affected 4.19.299 – < 4.20
- affected 5.1
- unaffected < 5.1
- unaffected 5.15.216 – ≤ 5.15.*
- unaffected 6.1.183 – ≤ 6.1.*
- unaffected 6.6.152 – ≤ 6.6.*
- unaffected 6.12.104 – ≤ 6.12.*
- unaffected 6.18.45 – ≤ 6.18.*
- unaffected 7.1.9 – ≤ 7.1.*
- unaffected 7.2 – ≤ *
References
References7
- https://git.kernel.org/stable/c/53c7938d8bcfde3296ec1a347ba2a9393c1fdcfa (opens in a new tab)
- https://git.kernel.org/stable/c/feb71634bb1abab3e8fb5cde874b27001cc1282e (opens in a new tab)
- https://git.kernel.org/stable/c/01865e1ddb126b25ac9eba5cdd7ec49e11183a64 (opens in a new tab)
- https://git.kernel.org/stable/c/00f89433777236ced4771211047fb5d4cd581cea (opens in a new tab)
- https://git.kernel.org/stable/c/78e5ebcd1c10ed7c8bda0a99e0abd5b62da86d67 (opens in a new tab)
- https://git.kernel.org/stable/c/ff5bcd804b5bc5c64736b7d318c20e12ea9506b8 (opens in a new tab)
- https://git.kernel.org/stable/c/185a4caeecabc150106deda1da170b09f2ad803f (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-64379 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-74692)Record last updated .