CVE-2026-53274

What it actually does

This is a local denial-of-service flaw in the Linux kernel's SMC networking code. The vulnerable path in __smc_setsockopt() performs a user-space memory copy via copy_from_sockptr() while holding the socket lock with lock_sock(sk). A local unprivileged process can provide an optval pointer backed by userfaultfd-monitored memory, or in some configurations FUSE-backed memory, and intentionally stall the copy operation. Because the socket lock remains held while the copy is blocked, concurrent socket teardown paths such as shutdown() can block behind the lock, consume kernel worker threads, and eventually trigger hung-task detection or system instability. The issue does not directly provide code execution or privilege escalation, but it can degrade or halt affected systems through kernel worker exhaustion and blocked networking operations.

Why it matters to the business

An attacker who already has local code execution on a Linux system may be able to make the host unresponsive or disrupt workloads by exhausting kernel worker threads and causing hung kernel tasks. The main operational risk is service outage, degraded application availability, failed networking operations, and potential need for manual recovery or reboot. The low EPSS score and absence from the CISA KEV catalog indicate no known broad exploitation at this time, but local multi-user systems, shared compute platforms, container hosts that expose the relevant kernel functionality, and systems that permit unprivileged userfaultfd or FUSE-backed memory usage should treat the issue as a stability and availability concern.

How an attack unfolds

An attacker first obtains the ability to run unprivileged local code on a vulnerable Linux host. They create or use an SMC socket and call setsockopt() in a way that reaches the vulnerable __smc_setsockopt() kernel path. For the option value buffer, they pass a pointer to memory that can intentionally block during the kernel's copy_from_sockptr() operation, such as a userfaultfd-monitored page or a FUSE-backed mapping. Because the vulnerable kernel code holds the socket lock while copying from that user-controlled memory, the attacker can pause the copy and keep the socket lock held indefinitely. They then trigger or race asynchronous teardown behavior, such as shutdown(), causing kernel worker threads to block waiting for the same socket lock. Repeating or sustaining the condition can exhaust kernel worker capacity, produce hung-task watchdog messages, and disrupt normal system operation.

How to fix it

Upgrade to a Linux kernel version that includes the fix moving the user-space copy out of the lock_sock() critical section in net/smc __smc_setsockopt(). If vendor-specific fixed kernel package versions are available, apply the relevant distribution kernel update rather than attempting to patch only the source file manually. Where immediate patching is not possible, reduce exposure by limiting untrusted local shell access, restricting container escape paths to host kernel interfaces, disabling or restricting unprivileged userfaultfd where supported, limiting unprivileged FUSE usage where operationally feasible, and disabling or blacklisting SMC support if it is not required. Mitigations reduce exploitability but should not be considered substitutes for applying the corrected kernel.

How to confirm the fix worked

Confirm that systems are running a vendor kernel build that contains the net/smc __smc_setsockopt() fix. Validate through the distribution's package changelog, kernel advisory, or source patch history rather than relying only on the upstream version string, because vendors frequently backport fixes. Check whether SMC support is present or loaded, for example by reviewing loaded modules and kernel configuration for SMC-related support. Confirm that unprivileged userfaultfd and FUSE policies match the intended hardening posture. After patching, controlled testing should show that a stalled user-space optval copy cannot hold the SMC socket lock indefinitely and does not cause kworker exhaustion or hung-task watchdog messages during SMC socket teardown.

Typical attack path

1. Gain local ability to execute code as an unprivileged user on a vulnerable Linux system.
2. Create an SMC socket or otherwise invoke the kernel SMC setsockopt() path.
3. Prepare an option-value buffer backed by userfaultfd-monitored memory or another blocking user-space backing such as FUSE where applicable.
4. Call setsockopt() so __smc_setsockopt() attempts copy_from_sockptr() while holding the socket lock.
5. Stall the memory copy, causing the kernel to retain the socket lock indefinitely.
6. Trigger shutdown() or related asynchronous socket teardown operations that require the same lock.
7. Repeat or sustain the condition until kernel workers block, hung-task watchdog events occur, and system availability is degraded.

How to detect it

Review kernel logs, system journals, crash dumps, and monitoring telemetry for evidence of hung kernel worker threads, especially messages that reference SMC shutdown paths, socket locking, or long-blocked kworker tasks. Useful log sources include dmesg, journalctl -k, /var/log/kern.log, /var/log/messages, systemd journal kernel facilities, kernel hung-task watchdog output, and any EDR telemetry that records process-level system call behavior. Look for repeated setsockopt() activity against SMC sockets by local unprivileged processes, use of userfaultfd or FUSE-backed mappings immediately before kernel stalls, and clusters of shutdown() calls involving SMC sockets. Because this vulnerability causes denial of service rather than a persistent implant, durable artifacts may be limited to kernel log entries, hung-task traces, process accounting, audit logs, and crash dumps captured during the event.

• INFO: task kworker
• blocked for more than 120 seconds
• hung task
• hung_task
• smc_shutdown
• lock_sock_nested
• __smc_setsockopt
• copy_from_sockptr
• net/smc
• kernel: INFO: task kworker
• Call Trace:
• userfaultfd
• /dev/fuse

What your security team should do

• Prioritize kernel updates on multi-user Linux systems, shared compute hosts, container hosts, and systems where untrusted users can execute local code.
• Verify vendor advisories for the exact fixed kernel package applicable to each Linux distribution and track remediation through normal kernel patch management.
• Harden local attack surface by restricting unprivileged userfaultfd and unprivileged FUSE where business requirements allow.
• Assess whether SMC networking is required; disable or prevent loading of SMC functionality on systems that do not use it.
• Monitor kernel logs for hung kworker tasks involving smc_shutdown, lock_sock_nested, or __smc_setsockopt().
• Investigate unexplained system stalls, kworker exhaustion, or repeated hung-task watchdog messages on systems with local untrusted users.
• Treat exploitation as a local post-compromise availability technique rather than a remote initial-access vector.