CVE-2026-74692

A flaw was found in the Linux kernel's net/smc component. A time-of-check to time-of-use (TOCTOU) race condition allows a remote attacker to exploit a window where the listener's state is checked without proper locking. By opening TCP connections while the server is closing, an attacker can cause a memory leak. This can lead to kernel memory exhaustion and a Denial of Service (DoS) for the system.

A TOCTOU race in net smc listener handling allows smc_listen_out() to test the listener state before taking the listener lock. If the listener is closed in the window between the unlocked state check and smc_accept_enqueue(), a child socket can be enqueued on a dead listener and the sock_hold reference taken by smc_accept_enqueue() is not released. A remote peer can contribute to triggering this by opening TCP connections to an SMC listener while the server closes or restarts the listener, causing leaked smc_sock and clcsock objects and eventual kernel memory exhaustion. For the CVSS the PR:N is used because the attacker only needs network reachability to the exposed SMC service and does not need a local account on the victim. The issue is network reachable but timing dependent because the close path must race with handshake work already running on smc_hs_wq. Impact is denial of service via resource exhaustion. No direct confidentiality or integrity primitive is evident from the patch context.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.