CVE-2026-74692

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A TOCTOU (Time-of-Check to Time-of-Use) race condition exists between the smc listen out() and smc close active() functions. The smc listen out() function reads the sk state variable without holding the listener lock and only acquires lock sock nested() after the check passes. This allows smc close active() to transition the listener to SMC CLOSED and release the lock before smc listen out() acquires it. Consequently, smc accept enqueue() may enqueue a child socket on a closed listener, leading to a memory leak of the child smc sock, its clcsock, and the associated reference. A remote peer can exploit this by opening TCP connections while the server is closing, potentially exhausting kernel memory.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.