CVE-2026-53274 Details

A logic flaw in the Linux kernel's socket management communication (SMC) handling has been identified, allowing a local unprivileged user to cause a denial-of-service (DoS) condition. This vulnerability arises in the '__smc_setsockopt()' function, which manages socket options. While executing, the function holds a lock on the socket, preventing other operations from proceeding. An attacker can exploit this by sending a memory page monitored by 'userfaultfd' (or a FUSE-backed memory page on systems where unprivileged 'userfaultfd' is disabled) as the option value. This manipulation halts the execution of the copy operation, keeping the socket lock engaged indefinitely. When combined with asynchronous operations like 'shutdown()', this exploitation depletes the kernel's worker queue and activates the hung task watchdog, which monitors and reports tasks that have been blocked for an extended period.

The vulnerability has been addressed by modifying the '__smc_setsockopt()' function to move the user-space data copy operation outside of the socket lock critical section, thereby preventing the lock from being held indefinitely.