Executive brief
A vulnerability in the Linux kernel's Shared Memory Communications (SMC) component allows a local user to crash or freeze the system. By exploiting a flaw in how the system handles network socket settings, an attacker can cause the kernel to wait indefinitely while holding a critical lock. This leads to a system-wide denial of service, preventing other operations and potentially requiring a hard reboot.
Technical details
A logic flaw exists in the __smc_setsockopt() function in net/smc/af_smc.c. The function calls copy_from_sockptr() while holding the lock_sock(sk) mutex. A local attacker can provide a memory address monitored by userfaultfd (or a FUSE-backed page) as the optval argument. This causes the kernel to sleep during the copy operation while still holding the socket lock. When combined with asynchronous operations like shutdown(), this leads to kernel worker (kworker) exhaustion and triggers the hung task watchdog, resulting in a local Denial of Service. The fix involves moving the user-space copy operation outside of the critical section protected by lock_sock().
Affected products
- Linux Linux Kernel 5.18 to 6.12.94
Timeline
- 2026-05-10: other: Vulnerability fixed in source code by Nicolò Coccia
- 2026-06-19: patched: Patch committed to stable tree by Greg Kroah-Hartman
- 2026-06-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/35a22117839602bb52283de08894c5a7dde92420
- https://git.kernel.org/stable/c/5d27d2ffe487df89ce28fda0410eafa05dbe03a0
- https://git.kernel.org/stable/c/89f6fbe0033c942cb790ffd53ca93a45eeaf1c91
- https://git.kernel.org/stable/c/94d286fa5eedc550d42bcb9c85416af8f77736ff
- https://git.kernel.org/stable/c/a3fdd924d88c30b9f488636ce0e4696012cf5511
- https://git.kernel.org/stable/c/dcd90f42a33e4220385f27b515183d0c91b2fc4a