PT-2026-52369 · Linux · Linux
Published
2026-06-25
·
Updated
2026-06-25
·
CVE-2026-53274
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
net/smc: fix sleep-inside-lock in smc setsockopt() causing local DoS
A logic flaw in smc setsockopt() allows a local unprivileged user to
cause a Denial of Service (DoS) by holding the socket lock indefinitely.
The function smc setsockopt() calls copy from sockptr() while holding
lock sock(sk). By passing a userfaultfd-monitored memory page (or
FUSE-backed memory on systems where unprivileged userfaultfd is disabled)
as the optval, an attacker can halt execution during the copy operation,
keeping the lock held.
Combined with asynchronous tear-down operations like shutdown(), this
exhausts the kernel wq (kworkers) and triggers the hung task watchdog.
[ 240.123456] INFO: task kworker/u8:2 blocked for more than 120 seconds.
[ 240.123489] Call Trace:
[ 240.123501] smc shutdown+...
[ 240.123512] lock sock nested+...
This patch moves the user-space copy outside the lock sock() critical
section to prevent the issue.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux