Linux Kernel CVE-2026-53274

The vulnerability resides in net/smc/__smc_setsockopt() within the Linux kernel's SMC (Shared Memory Communications) subsystem, a socket-level protocol providing RDMA-accelerated transparent socket replacement used primarily in high-performance and IBM mainframe networking environments. CPE coverage is cpe:2.3:o:linux:linux_kernel (multiple stable branches). The root cause is improper locking discipline: copy_from_sockptr() - a blocking user-space copy - is called while the socket lock (lock_sock(sk)) is held. An attacker exploits this by passing an optval pointer backed by a userfaultfd-monitored memory page, causing copy_from_sockptr() to fault and block indefinitely in user space without releasing the lock. Concurrent socket teardown operations (shutdown()) then queue SMC teardown work on kernel worker threads (kworkers) that can never acquire the held lock, eventually exhausting the kernel workqueue and triggering the hung task watchdog (visible after 120 seconds as per the commit log). The fix relocates the copy_from_sockptr() call to outside the lock_sock() critical section. CWE is listed as N/A, but the root cause maps to improper locking / sleep-in-atomic-context (analogous to CWE-667 Improper Locking).