CVE-2026-74692 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, Linux distribution maintainers, and users of Linux-based systems should be aware of this vulnerability and take steps to ensure that their systems are updated with the fix.

Why it matters

A TOCTOU race condition vulnerability in the Linux kernel's net/smc subsystem can lead to a use-after-free condition, potentially causing denial-of-service or other unspecified impacts. Linux kernel developers, maintainers, and users should be aware of this vulnerability and take steps to ensure that their systems are updated with the fix.

• Denial-of-service due to use-after-free condition
• Potential for unspecified impacts due to TOCTOU race condition
• Need for patching and updating Linux kernel versions
• Verification of Linux kernel versions and configurations

Technical summary

The vulnerability is caused by a TOCTOU (Time-of-Check-to-Time-of-Use) race condition between smc_listen_out() and listener close. This can lead to a use-after-free condition and potentially cause a denial-of-service or other unspecified impacts. The vulnerability is located in the Linux kernel's net/smc subsystem. The issue arises from smc_listen_out() reading lsmc->sk.sk_state without the listener lock, then acquiring lock_sock_nested() only after the check passes. This opens a window where smc_close_active() can transition the listener to SMC_CLOSED, call smc_close_cleanup_listen() to drain the accept queue, and release the lock, all between the lockless read and the delayed lock acquisition. A remote peer

Defensive priority

High

Recommended defensive actions

• Review and apply the provided patches to the Linux kernel
• Ensure that the Linux kernel is updated to a version that includes the fix
• Monitor the Linux kernel for any potential issues related to this vulnerability
• Perform a thorough review of the system configuration and ensure that all necessary security measures are in place
• Verify that the Linux kernel versions and configurations are up-to-date and compliant with organizational security policies
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is caused by a TOCTOU (Time-of-Check-to-Time-of-Use) race condition between smc_listen_out() and listener close. This can lead to a use-after-free condition and potentially cause a denial-of-service or other unspecified impacts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.