In the Linux kernel, the following vulnerability has been resolved:
net/handshake: Take a long-lived file reference at submit
handshake_nl_accept_doit() needs the file pointer backing
req->hr_sk->sk_socket to survive the window between
handshake_req_next() and the subsequent FD_PREPARE() and get_file().
The submit-side sock_hold() does not provide that. sk_refcnt keeps
struct sock alive, but struct socket is owned by sock->file: when
the consumer fputs the last file reference, sock_release() tears
the socket down regardless of any sock_hold.
Add an hr_file pointer to struct handshake_req and acquire an
explicit reference on sock->file during handshake_req_submit().
handshake_complete() and handshake_req_cancel() release the
reference on the completion-bit-winning path.
The submit error path must also release the file reference, but
after rhashtable insertion a concurrent handshake_req_cancel() can
discover the request and race the error path. Gate the error-path
cleanup -- sk_destruct restoration, fput, and request destruction
-- with test_and_set_bit(HANDSHAKE_F_REQ_COMPLETED), the same
serialization handshake_complete() and handshake_req_cancel()
already use. When cancel has already claimed ownership, the submit
error path returns without touching the request; socket teardown
handles final destruction.
The accept-side dereferences are not yet retargeted; that change
comes in the next patch.
References
Configurations
Configuration 1 (hide)
|
History
12 Nov 2026, 21:11
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* |
|
| First Time |
Linux linux Kernel
Linux |
|
| References | () https://git.kernel.org/stable/c/09dba37eee70d0596e26645015f1aa95a9848e9d - Patch | |
| References | () https://git.kernel.org/stable/c/16eaba5aa89c04eea125905bb8f988c1897f4f29 - Patch | |
| References | () https://git.kernel.org/stable/c/22e371a93563c30ebebc576db049785e0d7fc617 - Patch | |
| References | () https://git.kernel.org/stable/c/685b10dd0e32c7782cead16c8cf055c609678583 - Patch | |
| References | () https://git.kernel.org/stable/c/b913801ad9b9a51437d84d030ec6843e08976bd6 - Patch |
21 Oct 2026, 13:19
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
19 Oct 2026, 21:17
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-416 |
Information
Published : 2026-07-25 10:17
Updated : 2026-11-12 21:11
NVD link : CVE-2026-64523
Mitre link : CVE-2026-64523
CVE.ORG link : CVE-2026-64523
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-416
Use After Free