A logic flaw in the Linux kernel function __smc_setsockopt() allows a local unprivileged user to cause a Denial of Service (DoS) by holding a socket… (CVE-2026-53274)
A logic flaw in the Linux kernel function __smc_setsockopt() allows a local unprivileged user to cause a Denial of Service (DoS) by holding a socket lock indefinitely. This occurs because the function performs a user-space memory copy while holding a socket lock, which can be exploited using userfaultfd-monitored or FUSE-backed memory to halt execution and keep the lock held. This leads to exhaustion of kernel worker threads and triggers the hung task watchdog, causing system instability. The issue has been fixed by moving the user-space copy operation outside the critical lock section.
AI Analysis
Technical Summary
The vulnerability in the Linux kernel's net/smc subsystem involves a sleep-inside-lock condition in the __smc_setsockopt() function. Specifically, the function holds the socket lock while calling copy_from_sockptr(), which copies data from user space. An attacker can pass a specially crafted memory page monitored by userfaultfd or backed by FUSE to halt the copy operation, thereby holding the socket lock indefinitely. This causes local Denial of Service by exhausting kernel worker threads (kworkers) and triggering the hung task watchdog. The patch resolves the issue by relocating the user-space copy outside the lock_sock() critical section.
Potential Impact
Local unprivileged users can cause a Denial of Service by indefinitely holding a socket lock, leading to exhaustion of kernel worker threads and system instability. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability has been resolved in the Linux kernel by moving the user-space copy operation outside the socket lock critical section. Users and administrators should monitor official Linux kernel advisories for patches addressing CVE-2026-53274 and apply them promptly once available.
A logic flaw in the Linux kernel function __smc_setsockopt() allows a local unprivileged user to cause a Denial of Service (DoS) by holding a socket… (CVE-2026-53274)
Description
A logic flaw in the Linux kernel function __smc_setsockopt() allows a local unprivileged user to cause a Denial of Service (DoS) by holding a socket lock indefinitely. This occurs because the function performs a user-space memory copy while holding a socket lock, which can be exploited using userfaultfd-monitored or FUSE-backed memory to halt execution and keep the lock held. This leads to exhaustion of kernel worker threads and triggers the hung task watchdog, causing system instability. The issue has been fixed by moving the user-space copy operation outside the critical lock section.
CVSS v3.1
Score 5.5medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in the Linux kernel's net/smc subsystem involves a sleep-inside-lock condition in the __smc_setsockopt() function. Specifically, the function holds the socket lock while calling copy_from_sockptr(), which copies data from user space. An attacker can pass a specially crafted memory page monitored by userfaultfd or backed by FUSE to halt the copy operation, thereby holding the socket lock indefinitely. This causes local Denial of Service by exhausting kernel worker threads (kworkers) and triggering the hung task watchdog. The patch resolves the issue by relocating the user-space copy outside the lock_sock() critical section.
Potential Impact
Local unprivileged users can cause a Denial of Service by indefinitely holding a socket lock, leading to exhaustion of kernel worker threads and system instability. There is no impact on confidentiality or integrity, only availability is affected.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability has been resolved in the Linux kernel by moving the user-space copy operation outside the socket lock critical section. Users and administrators should monitor official Linux kernel advisories for patches addressing CVE-2026-53274 and apply them promptly once available.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-22m3-g27g-5h2v
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-53274"]
- Ecosystems
- []
- Database Specific Severity
- MODERATE
- Cvss Version
- 3.1
Threat ID: 6a4e4edac9d9e3dbe3288656
Added to database: 07/08/2026, 13:21:30 UTC
Last enriched: 07/08/2026, 13:33:14 UTC
Last updated: 07/31/2026, 19:24:46 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.