EUVD-2026-64379
GHSA-r9r5-95ff-67hq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Race condition requires timing TCP connections against server close() window, warranting AC:H; no authentication, confidentiality, or integrity impact applies.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
net/smc: fix TOCTOU race between smc_listen_out() and listener close
smc_listen_out() reads lsmc->sk.sk_state without the listener lock, then acquires lock_sock_nested() only after the check passes. This opens a window where smc_close_active() can transition the listener to SMC_CLOSED, call smc_close_cleanup_listen() to drain the accept queue, and release the lock, all between the lockless read and the delayed lock acquisition:
smc_listen_work (smc_hs_wq) smc_close_active() ------------------------------- ------------------------- release_sock(child) if (sk_state == SMC_LISTEN) TRUE lock_sock(listener) sk_state = SMC_CLOSED smc_close_cleanup_listen() release_sock(listener) flush_work(tcp_listen_work) lock_sock_nested(listener) smc_accept_enqueue(listener, child) /* child enqueued on dead listener */
smc_close_active() flushes only tcp_listen_work. Work items already dispatched onto smc_hs_wq for the CLC handshake continue running unguarded. smc_accept_enqueue() takes a sock_hold() on the child that is never released, so the child smc_sock, its clcsock, and the reference all leak. A remote peer that opens TCP connections while the server calls close() can exhaust kernel memory.
Move lock_sock_nested() to before the sk_state check so that the test and the enqueue are atomic under the listener lock.
AnalysisAI
Kernel memory exhaustion in the Linux net/smc subsystem enables remote denial-of-service against servers using SMC listen sockets. A TOCTOU race between smc_listen_out() and listener socket close allows an unauthenticated remote attacker to enqueue child socket objects onto a dead listener - each leaking a smc_sock, clcsock, and unreleased reference - by flooding TCP connections during the server's close() window. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concurrent conditions: (1) the target Linux kernel must have the smc module loaded and the AF_SMC socket family available; (2) a server application must be actively listening on an SMC socket (AF_SMC or transparent SMC mode), as standard TCP-only applications are not affected; and (3) the attacker's TCP connection attempts must arrive during the brief window between the server's sk_state check and its lock_sock_nested() acquisition - a transient race that requires sustained connection flooding to trigger reliably. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) reflects a network-exploitable unauthenticated availability flaw, but the AC:L designation is generous for a race condition that requires timing remote TCP connections against a server's close() call - an independent assessment of AC:H is more appropriate, reducing the effective score to approximately 5.9. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker on the network sends a sustained flood of TCP connection attempts to a server application using SMC listen sockets, targeting the transient race window that opens when the server application calls close() on its listener. Each successful race iteration enqueues a child smc_sock on the dead listener with a sock_hold() reference that is never released, leaking the child socket and its clcsock; repeating across many connection cycles gradually exhausts kernel slab memory, eventually triggering an out-of-memory condition or kernel instability. … |
| Remediation | Upgrade the Linux kernel to a patched stable release for the deployed series: 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, or 7.2+, with individual fix commits available at https://git.kernel.org/stable/c/53c7938d8bcfde3296ec1a347ba2a9393c1fdcfa and related references. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify Linux systems using SMC protocol (inspect running services and kernel configuration for AF_SMC socket usage) and assess deployment scope; disable SMC if not operationally required. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today