CVE-2026-53274

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS A logic flaw in __smc_setsockopt() allows a local unprivileged user to cause a Denial of Service (DoS) by holding the socket lock indefinitely. The function __smc_setsockopt() calls copy_from_sockptr() while holding lock_sock(sk). By passing a userfaultfd-monitored memory page (or FUSE-backed memory on systems where unprivileged userfaultfd is disabled) as the optval, an attacker can halt execution during the copy operation, keeping the lock held. Combined with asynchronous tear-down operations like shutdown(), this exhausts the kernel wq (kworkers) and triggers the hung task watchdog. [ 240.123456] INFO: task kworker/u8:2 blocked for more than 120 seconds. [ 240.123489] Call Trace: [ 240.123501] smc_shutdown+... [ 240.123512] lock_sock_nested+... This patch moves the user-space copy outside the lock_sock() critical section to prevent the issue.

CVSS

No CVSS.

References

Link	Resource
https://git.kernel.org/stable/c/35a22117839602bb52283de08894c5a7dde92420
https://git.kernel.org/stable/c/5d27d2ffe487df89ce28fda0410eafa05dbe03a0
https://git.kernel.org/stable/c/89f6fbe0033c942cb790ffd53ca93a45eeaf1c91
https://git.kernel.org/stable/c/94d286fa5eedc550d42bcb9c85416af8f77736ff
https://git.kernel.org/stable/c/a3fdd924d88c30b9f488636ce0e4696012cf5511
https://git.kernel.org/stable/c/dcd90f42a33e4220385f27b515183d0c91b2fc4a

Configurations

No configuration.

History

25 Jun 2026, 09:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-06-25 09:16

Updated : 2026-06-25 09:16

NVD link : CVE-2026-53274

Mitre link : CVE-2026-53274

CVE.ORG link : CVE-2026-53274

JSON object : View

Products Affected

No product.

CWE

No CWE.

{"id": "CVE-2026-53274", "cveTags": [], "metrics": {}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "a6a6fe27bab48f0d09a64b051e7bde432fcae081", "lessThan": "35a22117839602bb52283de08894c5a7dde92420", "versionType": "git"}, {"status": "affected", "version": "a6a6fe27bab48f0d09a64b051e7bde432fcae081", "lessThan": "5d27d2ffe487df89ce28fda0410eafa05dbe03a0", "versionType": "git"}, {"status": "affected", "version": "a6a6fe27bab48f0d09a64b051e7bde432fcae081", "lessThan": "89f6fbe0033c942cb790ffd53ca93a45eeaf1c91", "versionType": "git"}, {"status": "affected", "version": "a6a6fe27bab48f0d09a64b051e7bde432fcae081", "lessThan": "dcd90f42a33e4220385f27b515183d0c91b2fc4a", "versionType": "git"}, {"status": "affected", "version": "a6a6fe27bab48f0d09a64b051e7bde432fcae081", "lessThan": "94d286fa5eedc550d42bcb9c85416af8f77736ff", "versionType": "git"}, {"status": "affected", "version": "a6a6fe27bab48f0d09a64b051e7bde432fcae081", "lessThan": "a3fdd924d88c30b9f488636ce0e4696012cf5511", "versionType": "git"}], "programFiles": ["net/smc/af_smc.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.18"}, {"status": "unaffected", "version": "0", "lessThan": "5.18", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.176", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.143", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.94", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.36", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.13", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/smc/af_smc.c"], "defaultStatus": "affected"}]}], "published": "2026-06-25T09:16:45.577", "references": [{"url": "https://git.kernel.org/stable/c/35a22117839602bb52283de08894c5a7dde92420", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/5d27d2ffe487df89ce28fda0410eafa05dbe03a0", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/89f6fbe0033c942cb790ffd53ca93a45eeaf1c91", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/94d286fa5eedc550d42bcb9c85416af8f77736ff", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a3fdd924d88c30b9f488636ce0e4696012cf5511", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/dcd90f42a33e4220385f27b515183d0c91b2fc4a", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Received", "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS\n\nA logic flaw in __smc_setsockopt() allows a local unprivileged user to\ncause a Denial of Service (DoS) by holding the socket lock indefinitely.\n\nThe function __smc_setsockopt() calls copy_from_sockptr() while holding\nlock_sock(sk). By passing a userfaultfd-monitored memory page (or\nFUSE-backed memory on systems where unprivileged userfaultfd is disabled)\nas the optval, an attacker can halt execution during the copy operation,\nkeeping the lock held.\n\nCombined with asynchronous tear-down operations like shutdown(), this\nexhausts the kernel wq (kworkers) and triggers the hung task watchdog.\n\n[ 240.123456] INFO: task kworker/u8:2 blocked for more than 120 seconds.\n[ 240.123489] Call Trace:\n[ 240.123501] smc_shutdown+...\n[ 240.123512] lock_sock_nested+...\n\nThis patch moves the user-space copy outside the lock_sock() critical\nsection to prevent the issue."}], "lastModified": "2026-06-25T09:16:45.577", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}