Linux kernel net/smc: listener close race leaks child sockets, letting a remote peer exhaust kernel memory

Impact

smc_listen_out() tests the listener's sk_state before taking the listener lock, so a handshake work item can enqueue a child socket onto a listener that smc_close_active() has already drained and marked SMC_CLOSED. The enqueue takes a sock_hold() that is never dropped, so the child smc_sock, its backing TCP clcsock and the reference all leak permanently. A remote peer that keeps opening connections while the server closes its listening socket can drive unbounded non-reclaimable kernel allocations until the node OOMs. This only bites hosts that actually use SMC - on GPU fleets that means SMC-R over RoCE-capable ConnectX NICs, where the leak is on the same host kernel that owns the RDMA data path; hosts with no AF_SMC listener are unaffected.

Who can reach it

A remote peer that can open TCP connections to an SMC listener on the host, with no authentication required, and only during the window in which the server closes that listening socket. Not reachable from a tenant GPU pod unless the pod can reach an SMC listener; not reachable at all if no service on the node listens on AF_SMC.

What to do

Take the stable-kernel fix from the linked commits; the advisory names no single fixed release, so track the backport into your distro kernel rather than a version number here. Applying it means booting a patched kernel, so each node has to be cordoned, drained and rebooted - expensive on GPU nodes holding long training jobs. If SMC is not needed, the cheaper interim step is to keep the smc module unloaded or blacklisted, which removes the exposure entirely without a reboot.

References

Related entries

• Linux kernel vhost-scsi (VHOST_SET_FEATURES after endpoint setup): vhost_scsi_setup_vq_cmds() sizes each command'sCVE-2026-74702 · Linux kernel vhost-scsi (VHOST_SET_FEATURES after endpoint setup)Unscored
• Linux kernel vhost-scsi: malformed guest request with T10 protection bytes panics the hostCVE-2026-74703 · Linux kernel vhost-scsi (T10 PI scatterlist count validation)Unscored
• Linux kernel mlx5 vDPA: memory-region key creation reads past the firmware command bufferCVE-2026-74712 · Linux kernel mlx5_vdpa (create_direct_keys input buffer length)Unscored
• Linux kernel BPF TCP iterator: stolen reference on a half-published request socket ends in use-after-freeCVE-2026-74714 · Linux kernel BPF TCP iterator (bpf_iter_tcp_established_batch refcount)Unscored
• Linux kernel BPF conntrack kfuncs: racing opts update unbalances the netns reference countCVE-2026-74715 · Linux kernel BPF conntrack kfuncs (opts->netns_id get/put pairing)Unscored
• Linux kernel SMC-R: duplicate LLC link messages from a peer leak one kmalloc-96 object eachCVE-2026-74719 · Linux kernel SMC-R LLC event handler (duplicate CONFIRM_LINK / ADD_LINK_CONT qentry)Unscored