CVE-2026-53274

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/smc: fix sleep-inside-lock in __smc_setsockopt() causing local DoS

A logic flaw in __smc_setsockopt() allows a local unprivileged user to

cause a Denial of Service (DoS) by holding the socket lock indefinitely.

The function __smc_setsockopt() calls copy_from_sockptr() while holding

lock_sock(sk). By passing a userfaultfd-monitored memory page (or

FUSE-backed memory on systems where unprivileged userfaultfd is disabled)

as the optval, an attacker can halt execution during the copy operation,

keeping the lock held.

Combined with asynchronous tear-down operations like shutdown(), this

exhausts the kernel wq (kworkers) and triggers the hung task watchdog.

[ 240.123456] INFO: task kworker/u8:2 blocked for more than 120 seconds.

[ 240.123489] Call Trace:

[ 240.123501] smc_shutdown+...

[ 240.123512] lock_sock_nested+...

This patch moves the user-space copy outside the lock_sock() critical

section to prevent th

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References