Executive brief
The Linux kernel's SMC (Shared Memory Communications) network protocol contains a timing vulnerability that allows remote attackers to cause a denial of service by exhausting kernel memory. When a server closes a listener socket, a race condition can cause child connection objects to be queued onto a closed listener and never properly released. An attacker can repeatedly open TCP connections to trigger this leak until the server runs out of memory.
Technical details
This is a TOCTOU (time-of-check-to-time-of-use) race condition in the SMC protocol's listener handling code. The smc_listen_out() function reads the listener's socket state without holding a lock, then acquires the lock afterwards. During the window between the read and lock acquisition, smc_close_active() can transition the listener to SMC_CLOSED and drain the accept queue. Work items dispatched to smc_hs_wq continue executing unguarded, causing smc_accept_enqueue() to queue child connections onto a dead listener. This leaks socket references and kernel memory. The attack is remotely triggerable via TCP connections to a closing server. The fix moves the lock acquisition before the state check to ensure atomicity.
Affected products
- Linux Linux kernel affected versions prior to patch
Timeline
- 2026-08-22: disclosed
- other: Vulnerability resolved in kernel via race condition fix