Description: Set smux socket timeout
 The smux socket accepts connections and does a blocking recvfrom()
 This means if a remote system connects to the smux port and sends nothing
 then the entire snmpd daemon will hang.
 .
 Fixes: CVE-2026-89147
Author: Ali Firas
Origin: other, https://gist.github.com/thesmartshadow/001cea595e75fed6aaea7389666dc9eb
Bug-Debian: https://bugs.debian.org/1147442
Forwarded: no
Reviewed-by: Craig Small <csmall@debian.org>
Last-Update: 2026-09-14
--- a/agent/mibgroup/smux/smux.c
+++ b/agent/mibgroup/smux/smux.c
@@ -661,6 +661,16 @@
             return -1;
         }
 
+#ifdef SO_RCVTIMEO
+        if (setsockopt(fd, SOL_SOCKET, SO_RCVTIMEO, (void *) &tv,
+                       sizeof(tv)) < 0) {
+            DEBUGMSGTL(("smux",
+                        "[smux_accept] setsockopt(SO_RCVTIMEO) failed fd %d\n",
+                        fd));
+            snmp_log_perror("smux_accept: setsockopt SO_RCVTIMEO");
+        }
+#endif
+
         /*
          * now block for an OpenPDU 
          */
@@ -668,7 +678,7 @@
         {
            length = recvfrom(fd, (char *) data, SMUXMAXPKTSIZE, 0, NULL, NULL);
         }
-        while((length == -1) && ((errno == EINTR) || (errno == EAGAIN)));
+        while((length == -1) && (errno == EINTR));
 
         if (length <= 0) {
             DEBUGMSGTL(("smux",
