CVE-2026-53274: Linux Kernel SMC Socket Lock DoS Vulnerability

Technical summary

CVE-2026-53274 is a logic flaw in __smc_setsockopt() that introduces a sleep-inside-lock vulnerability. The function calls copy_from_sockptr() while holding lock_sock(sk), creating a window for local denial of service. An attacker can pass a userfaultfd-monitored or FUSE-backed memory page as optval, causing the copy to block indefinitely while the socket lock remains held. Concurrent shutdown() operations then attempt to acquire the same lock via smc_shutdown() → lock_sock_nested(), creating contention that exhausts kernel worker queue capacity and triggers hung task detection. The remediation moves the copy_from_sockptr() call outside the critical section.

Business impact

This vulnerability poses a localized availability risk. An authenticated local user can degrade system responsiveness and trigger automatic watchdog resets, potentially causing unplanned downtime or triggering cascading failures in containerized or multi-tenant environments where kernel resource exhaustion affects co-resident workloads. Public cloud instances, shared hosting, and development systems where unprivileged users have shell access face the highest operational risk. Remote exploitation is not possible; impact is confined to systems where untrusted local code execution is permitted.

Affected systems

All Linux kernel versions are potentially affected. The vulnerability exists in the SMC subsystem, which is enabled by default in many distributions but primarily impacts systems with active SMC socket usage—typically found in enterprise Linux deployments supporting high-performance networking, Oracle Real Application Clusters (RAC), or custom applications using AF_SMC sockets. Systems without SMC support or with SMC explicitly disabled are unaffected.

Exploitability

Exploitability requires local code execution as an unprivileged user and the ability to manipulate memory pages (via userfaultfd or FUSE). On modern systems with unprivileged userfaultfd disabled by default, FUSE-backed memory provides an alternative attack surface. Complexity is low once access is gained; no special kernel knowledge or race condition tuning is required. This is not a network-exploitable vulnerability and cannot be weaponized remotely.

Remediation

Apply a Linux kernel patch that restructures __smc_setsockopt() to perform copy_from_sockptr() before acquiring lock_sock(sk), eliminating the sleep-inside-lock window. Verify against your distribution's security advisory for the specific patched kernel version. Interim mitigation on vulnerable systems: disable SMC support (via kernel module blacklist or compile-time configuration) if not required, or restrict local shell access via standard access controls.

Patch guidance

Coordinate with your Linux distribution vendor for kernel updates addressing this issue. Patch availability will vary by distribution and release channel. Check your vendor's security bulletin for corresponding kernel versions—typically backported to stable and LTS branches. Test patches in non-production environments first, as kernel updates may require system reboot. For container images, rebuild with patched base OS images and redeploy.

Detection guidance

Monitor kernel logs for hung task warnings mentioning kworker threads blocked on lock_sock() or SMC-related functions. Correlate with user session activity and userfaultfd/FUSE mount creation. Audit systems for unprivileged userfaultfd enablement (check /proc/sys/vm/unprivileged_userns_clone). Threat hunting: review audit logs for creation of FUSE filesystems or userfaultfd usage by unprivileged accounts. Implement alerting on hung task detector triggers, particularly in environments with strict local user isolation requirements.

Why prioritize this

Assign medium priority. While CVSS 5.5 reflects local-only attack surface and low attack complexity, the vulnerability degrades availability in multi-tenant or high-concurrency environments. Prioritize patching for: (1) systems with untrusted local users, (2) Kubernetes nodes or container hosts where pod isolation is the primary trust boundary, (3) development/CI systems with shared accounts. Lower-priority for airgapped single-user or production systems with strict access controls, but plan patching in next regular maintenance window.

Risk score, explained

CVSS 3.1 score of 5.5 (MEDIUM) reflects attack vector limited to local (AV:L), no privilege escalation required (PR:L), low attack complexity (AC:L), and high availability impact (A:H) with no confidentiality or integrity risk. The score appropriately captures the local-only nature and direct DoS mechanism. However, context matters: systems with relaxed local access controls or container escape pathways may warrant elevation of operational risk assessment independent of CVSS.

Frequently asked questions