The vulnerability in the Linux kernel's net/smc subsystem involves a TOCTOU race condition between smc_listen_out() and smc_close_active(). smc_listen_out() reads the listener socket state without holding the listener lock, then acquires the lock after the check. This allows smc_close_active() to close the listener and drain the accept queue concurrently, leading to smc_accept_enqueue() enqueuing a child socket on a closed listener. This causes a sock_hold() reference leak on the child socket and associated resources, resulting in kernel memory exhaustion if exploited by a remote peer opening TCP connections during listener close. The fix moves the lock acquisition before the state check to make the operation atomic under the listener lock.

A remote peer can cause a kernel memory leak by repeatedly opening TCP connections while the server closes the listener socket, potentially exhausting kernel memory resources. This could lead to denial of service conditions on the affected system.

A fix has been implemented in the Linux kernel to address this vulnerability by moving the lock acquisition before the socket state check, ensuring atomicity and preventing the race condition. Users should apply the official kernel update that includes this fix. Patch status is not yet confirmed in this data; check the vendor or Linux kernel advisories for the current remediation guidance.