CVE-2026-74692

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/smc: fix TOCTOU race between smc_listen_out() and listener close

smc_listen_out() reads lsmc->sk.sk_state without the listener lock,

then acquires lock_sock_nested() only after the check passes. This

opens a window where smc_close_active() can transition the listener

to SMC_CLOSED, call smc_close_cleanup_listen() to drain the accept

queue, and release the lock, all between the lockless read and the

delayed lock acquisition:

smc_listen_work (smc_hs_wq) smc_close_active()

------------------------------- -------------------------

release_sock(child)

if (sk_state == SMC_LISTEN) TRUE

lock_sock(listener)

sk_state = SMC_CLOSED

smc_close_cleanup_listen()

release_sock(listener)

flush_work(tcp_listen_wor

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References