CVE-2026-74692: net/smc: fix TOCTOU race between smc_listen_out() and listener close

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net/smc: fix TOCTOU race between smc_listen_out() and listener close

smc_listen_out() reads lsmc->sk.sk_state without the listener lock,
then acquires lock_sock_nested() only after the check passes. This
opens a window where smc_close_active() can transition the listener
to SMC_CLOSED, call smc_close_cleanup_listen() to drain the accept
queue, and release the lock, all between the lockless read and the
delayed lock acquisition:

  smc_listen_work (smc_hs_wq)          smc_close_active()
  -------------------------------      -------------------------
  release_sock(child)
  if (sk_state == SMC_LISTEN) TRUE
                                        lock_sock(listener)
                                        sk_state = SMC_CLOSED
                                        smc_close_cleanup_listen()
                                        release_sock(listener)
                                        flush_work(tcp_listen_work)
  lock_sock_nested(listener)
  smc_accept_enqueue(listener, child) /* child enqueued on dead listener */

smc_close_active() flushes only tcp_listen_work. Work items already
dispatched onto smc_hs_wq for the CLC handshake continue running
unguarded. smc_accept_enqueue() takes a sock_hold() on the child that
is never released, so the child smc_sock, its clcsock, and the
reference all leak. A remote peer that opens TCP connections while the
server calls close() can exhaust kernel memory.

Move lock_sock_nested() to before the sk_state check so that the test
and the enqueue are atomic under the listener lock.

The Linux kernel CVE team has assigned CVE-2026-74692 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.1 with commit fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9 and fixed in 5.15.216 with commit 53c7938d8bcfde3296ec1a347ba2a9393c1fdcfa
	Issue introduced in 5.1 with commit fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9 and fixed in 6.1.183 with commit feb71634bb1abab3e8fb5cde874b27001cc1282e
	Issue introduced in 5.1 with commit fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9 and fixed in 6.6.152 with commit 01865e1ddb126b25ac9eba5cdd7ec49e11183a64
	Issue introduced in 5.1 with commit fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9 and fixed in 6.12.104 with commit 00f89433777236ced4771211047fb5d4cd581cea
	Issue introduced in 5.1 with commit fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9 and fixed in 6.18.45 with commit 78e5ebcd1c10ed7c8bda0a99e0abd5b62da86d67
	Issue introduced in 5.1 with commit fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9 and fixed in 7.1.9 with commit ff5bcd804b5bc5c64736b7d318c20e12ea9506b8
	Issue introduced in 5.1 with commit fd57770dd198f5b2ddd5b9e6bf282cf98d63adb9 and fixed in 7.2 with commit 185a4caeecabc150106deda1da170b09f2ad803f
	Issue introduced in 4.19.299 with commit d1d004585b40c212b338fc8a40cbaaf230ea4703

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74692
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/smc/af_smc.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/53c7938d8bcfde3296ec1a347ba2a9393c1fdcfa
	https://git.kernel.org/stable/c/feb71634bb1abab3e8fb5cde874b27001cc1282e
	https://git.kernel.org/stable/c/01865e1ddb126b25ac9eba5cdd7ec49e11183a64
	https://git.kernel.org/stable/c/00f89433777236ced4771211047fb5d4cd581cea
	https://git.kernel.org/stable/c/78e5ebcd1c10ed7c8bda0a99e0abd5b62da86d67
	https://git.kernel.org/stable/c/ff5bcd804b5bc5c64736b7d318c20e12ea9506b8
	https://git.kernel.org/stable/c/185a4caeecabc150106deda1da170b09f2ad803f