Threats Tagged 'cve-2026-53274'

A logic flaw in the Linux kernel function __smc_setsockopt() allows a local unprivileged user to cause a Denial of Service (DoS) by holding a socket lock indefinitely. This occurs because the function performs a user-space memory copy while holding a socket lock, which can be exploited using userfaultfd-monitored or FUSE-backed memory to halt execution and keep the lock held. This leads to exhaustion of kernel worker threads and triggers the hung task watchdog, causing system instability. The issue has been fixed by moving the user-space copy operation outside the critical lock section.

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS A logic flaw in __smc_setsockopt() allows a local unprivileged user to cause a Denial of Service (DoS) by holding the socket lock indefinitely. The function __smc_setsockopt() calls copy_from_sockptr() while holding lock_sock(sk). By passing a userfaultfd-monitored memory page (or FUSE-backed memory on systems where unprivileged userfaultfd is disabled) as the optval, an attacker can halt execution during the copy operation, keeping the lock held. Combined with asynchronous tear-down operations like shutdown(), this exhausts the kernel wq (kworkers) and triggers the hung task watchdog. [ 240.123456] INFO: task kworker/u8:2 blocked for more than 120 seconds. [ 240.123489] Call Trace: [ 240.123501] smc_shutdown+... [ 240.123512] lock_sock_nested+... This patch moves the user-space copy outside the lock_sock() critical section to prevent the issue.