Local Denial of Service Vulnerability in Linux Kernel Affecting Socket Operations

CVE-2026-53274

What is CVE-2026-53274?

A logic flaw in the Linux kernel's __smc_setsockopt() function can let a local unprivileged user trigger a Denial of Service (DoS). This issue arises when a socket lock is held indefinitely due to the function calling copy_from_sockptr() while the lock is in effect. By using a userfaultfd-monitored memory page or FUSE-backed memory, an attacker can pause the execution of the copy operation, keeping the lock locked. When combined with other asynchronous operations, such as shutdown(), this can exhaust the kernel worker queues, resulting in the hung task watchdog being triggered and a potential DoS situation.

References