Linux kernel net/smc __smc_setsockopt() sleep-inside-lock local DoS

CVE-2026-53274 is a local denial-of-service vulnerability in the Linux kernel's net/smc subsystem. The flaw is in __smc_setsockopt(), which calls copy_from_sockptr() while holding the socket lock via lock_sock(sk). Because the copy is performed from user-controlled memory inside the critical section, a local unprivileged attacker can supply an optval pointer backed by a userfaultfd-monitored page, or by FUSE-backed memory where unprivileged userfaultfd is unavailable, and stall the copy operation. This causes the socket lock to remain held indefinitely. When combined with asynchronous teardown paths such as shutdown(), kernel worker threads can block waiting on the same lock, leading to worker exhaustion and hung-task conditions. The fix moves the user-space copy outside the lock_sock() critical section.