Time-of-check Time-of-use (TOCTOU) Race Condition in Linux kernel - CVE-2026-74692

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to a time-of-check time-of-use race condition in smc_listen_out() in net/smc/af_smc.c when handling TCP connection attempts while a listener is being closed. A remote attacker can open TCP connections during the race window to cause a denial of service.

The issue can leak child smc_sock objects, their clcsock objects, and references, which can exhaust kernel memory.

Affected software

How to mitigate CVE-2026-74692

External References

• https://git.kernel.org/stable/c/00f89433777236ced4771211047fb5d4cd581cea
• https://git.kernel.org/stable/c/01865e1ddb126b25ac9eba5cdd7ec49e11183a64
• https://git.kernel.org/stable/c/185a4caeecabc150106deda1da170b09f2ad803f
• https://git.kernel.org/stable/c/53c7938d8bcfde3296ec1a347ba2a9393c1fdcfa
• https://git.kernel.org/stable/c/78e5ebcd1c10ed7c8bda0a99e0abd5b62da86d67
• https://git.kernel.org/stable/c/feb71634bb1abab3e8fb5cde874b27001cc1282e
• https://git.kernel.org/stable/c/ff5bcd804b5bc5c64736b7d318c20e12ea9506b8

Related Security Bulletins

• Time-of-check Time-of-use (TOCTOU) Race Condition in Linux kernel smc
• Debian update for linux