GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-64523 (GCVE-0-2026-64523)

Vulnerability from cvelistv5 – Published: 2026-07-25 09:20 – Updated: 2026-08-09 18:34
VLAI
Title
net/handshake: Take a long-lived file reference at submit
Summary
In the Linux kernel, the following vulnerability has been resolved: net/handshake: Take a long-lived file reference at submit handshake_nl_accept_doit() needs the file pointer backing req->hr_sk->sk_socket to survive the window between handshake_req_next() and the subsequent FD_PREPARE() and get_file(). The submit-side sock_hold() does not provide that. sk_refcnt keeps struct sock alive, but struct socket is owned by sock->file: when the consumer fputs the last file reference, sock_release() tears the socket down regardless of any sock_hold. Add an hr_file pointer to struct handshake_req and acquire an explicit reference on sock->file during handshake_req_submit(). handshake_complete() and handshake_req_cancel() release the reference on the completion-bit-winning path. The submit error path must also release the file reference, but after rhashtable insertion a concurrent handshake_req_cancel() can discover the request and race the error path. Gate the error-path cleanup -- sk_destruct restoration, fput, and request destruction -- with test_and_set_bit(HANDSHAKE_F_REQ_COMPLETED), the same serialization handshake_complete() and handshake_req_cancel() already use. When cancel has already claimed ownership, the submit error path returns without touching the request; socket teardown handles final destruction. The accept-side dereferences are not yet retargeted; that change comes in the next patch.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 3b3009ea8abb713b022d94fba95ec270cf6e7eae , < 685b10dd0e32c7782cead16c8cf055c609678583 (git)
Affected: 3b3009ea8abb713b022d94fba95ec270cf6e7eae , < b913801ad9b9a51437d84d030ec6843e08976bd6 (git)
Affected: 3b3009ea8abb713b022d94fba95ec270cf6e7eae , < 16eaba5aa89c04eea125905bb8f988c1897f4f29 (git)
Affected: 3b3009ea8abb713b022d94fba95ec270cf6e7eae , < 09dba37eee70d0596e26645015f1aa95a9848e9d (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.4
Unaffected: 0 , < 6.4 (semver)
Unaffected: 6.12.93 , ≤ 6.12.* (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.0.12 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/handshake/handshake.h",
            "net/handshake/netlink.c",
            "net/handshake/request.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "685b10dd0e32c7782cead16c8cf055c609678583",
              "status": "affected",
              "version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae",
              "versionType": "git"
            },
            {
              "lessThan": "b913801ad9b9a51437d84d030ec6843e08976bd6",
              "status": "affected",
              "version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae",
              "versionType": "git"
            },
            {
              "lessThan": "16eaba5aa89c04eea125905bb8f988c1897f4f29",
              "status": "affected",
              "version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae",
              "versionType": "git"
            },
            {
              "lessThan": "09dba37eee70d0596e26645015f1aa95a9848e9d",
              "status": "affected",
              "version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/handshake/handshake.h",
            "net/handshake/netlink.c",
            "net/handshake/request.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/handshake: Take a long-lived file reference at submit\n\nhandshake_nl_accept_doit() needs the file pointer backing\nreq-\u003ehr_sk-\u003esk_socket to survive the window between\nhandshake_req_next() and the subsequent FD_PREPARE() and get_file().\nThe submit-side sock_hold() does not provide that.  sk_refcnt keeps\nstruct sock alive, but struct socket is owned by sock-\u003efile: when\nthe consumer fputs the last file reference, sock_release() tears\nthe socket down regardless of any sock_hold.\n\nAdd an hr_file pointer to struct handshake_req and acquire an\nexplicit reference on sock-\u003efile during handshake_req_submit().\nhandshake_complete() and handshake_req_cancel() release the\nreference on the completion-bit-winning path.\n\nThe submit error path must also release the file reference, but\nafter rhashtable insertion a concurrent handshake_req_cancel() can\ndiscover the request and race the error path.  Gate the error-path\ncleanup -- sk_destruct restoration, fput, and request destruction\n-- with test_and_set_bit(HANDSHAKE_F_REQ_COMPLETED), the same\nserialization handshake_complete() and handshake_req_cancel()\nalready use.  When cancel has already claimed ownership, the submit\nerror path returns without touching the request; socket teardown\nhandles final destruction.\n\nThe accept-side dereferences are not yet retargeted; that change\ncomes in the next patch."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - An unauthenticated remote peer can make network-facing NFS/RPC-over-TLS or TLS-enabled NVMe/TCP consumers submit a handshake, then disconnect or force timeout while tlshd accepts it.\nAC:L - Connection churn lets the attacker repeatedly create handshake requests and drive cancellation while the normal agent accepts; no secret state or uncontrollable memory layout is required.\nPR:N - The RPC_AUTH_TLS probe and NVMe/TCP TLS setup occur before peer authentication. ACCEPT requires init-namespace CAP_NET_ADMIN, but trusted tlshd issues it automatically rather than the attacker.\nUI:N - Kernel consumers and the handshake daemon process the request automatically without any victim user action.\nS:U - Exploitation compromises resources governed by the same host-kernel security authority and does not inherently cross a VM, IOMMU, or other security boundary.\nC:H - The race can dereference reclaimed socket, file, or handshake-request memory; heap reuse of this UAF can provide access to arbitrary kernel data.\nI:H - The stale file pointer reaches refcount-writing operations such as get_file(), while reclaimed request data includes callback pointers, making arbitrary writes or control-flow hijacking defensible.\nA:H - The NULL dereference or use-after-free can cause a kernel oops or panic, and a remote attacker can trigger the race repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-09T18:34:58.632Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/685b10dd0e32c7782cead16c8cf055c609678583"
        },
        {
          "url": "https://git.kernel.org/stable/c/b913801ad9b9a51437d84d030ec6843e08976bd6"
        },
        {
          "url": "https://git.kernel.org/stable/c/16eaba5aa89c04eea125905bb8f988c1897f4f29"
        },
        {
          "url": "https://git.kernel.org/stable/c/09dba37eee70d0596e26645015f1aa95a9848e9d"
        }
      ],
      "title": "net/handshake: Take a long-lived file reference at submit",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64523",
    "datePublished": "2026-07-25T09:20:47.606Z",
    "dateReserved": "2026-07-19T15:36:31.794Z",
    "dateUpdated": "2026-08-09T18:34:58.632Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64523",
      "date": "2026-09-16",
      "epss": "0.00359",
      "percentile": "0.29469"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-11T01:02:30.000Z",
      "cve": "CVE-2026-64523",
      "id": "msrc_CVE-2026-64523",
      "initial_release_date": "2026-07-26T01:04:50.000Z",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net/handshake: Take a long-lived file reference at submit",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64523.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64523\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-25T10:17:38.597\",\"lastModified\":\"2026-08-09T19:17:02.097\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/handshake: Take a long-lived file reference at submit\\n\\nhandshake_nl_accept_doit() needs the file pointer backing\\nreq-\u003ehr_sk-\u003esk_socket to survive the window between\\nhandshake_req_next() and the subsequent FD_PREPARE() and get_file().\\nThe submit-side sock_hold() does not provide that.  sk_refcnt keeps\\nstruct sock alive, but struct socket is owned by sock-\u003efile: when\\nthe consumer fputs the last file reference, sock_release() tears\\nthe socket down regardless of any sock_hold.\\n\\nAdd an hr_file pointer to struct handshake_req and acquire an\\nexplicit reference on sock-\u003efile during handshake_req_submit().\\nhandshake_complete() and handshake_req_cancel() release the\\nreference on the completion-bit-winning path.\\n\\nThe submit error path must also release the file reference, but\\nafter rhashtable insertion a concurrent handshake_req_cancel() can\\ndiscover the request and race the error path.  Gate the error-path\\ncleanup -- sk_destruct restoration, fput, and request destruction\\n-- with test_and_set_bit(HANDSHAKE_F_REQ_COMPLETED), the same\\nserialization handshake_complete() and handshake_req_cancel()\\nalready use.  When cancel has already claimed ownership, the submit\\nerror path returns without touching the request; socket teardown\\nhandles final destruction.\\n\\nThe accept-side dereferences are not yet retargeted; that change\\ncomes in the next patch.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/handshake/handshake.h\",\"net/handshake/netlink.c\",\"net/handshake/request.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3b3009ea8abb713b022d94fba95ec270cf6e7eae\",\"lessThan\":\"685b10dd0e32c7782cead16c8cf055c609678583\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3b3009ea8abb713b022d94fba95ec270cf6e7eae\",\"lessThan\":\"b913801ad9b9a51437d84d030ec6843e08976bd6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3b3009ea8abb713b022d94fba95ec270cf6e7eae\",\"lessThan\":\"16eaba5aa89c04eea125905bb8f988c1897f4f29\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3b3009ea8abb713b022d94fba95ec270cf6e7eae\",\"lessThan\":\"09dba37eee70d0596e26645015f1aa95a9848e9d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/handshake/handshake.h\",\"net/handshake/netlink.c\",\"net/handshake/request.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.93\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.44\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.12\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/09dba37eee70d0596e26645015f1aa95a9848e9d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/16eaba5aa89c04eea125905bb8f988c1897f4f29\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/685b10dd0e32c7782cead16c8cf055c609678583\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b913801ad9b9a51437d84d030ec6843e08976bd6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-30T03:54:50+00:00",
      "cve": "CVE-2026-64523",
      "id": "CVE-2026-64523",
      "initial_release_date": "2026-07-25T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/handshake: Take a long-lived file reference at submit",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64523.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-10T02:21:20Z",
      "cve": "CVE-2026-64523",
      "id": "CVE-2026-64523",
      "initial_release_date": "2026-07-25T15:57:47Z",
      "product_status:known_affected": "83",
      "product_status:known_not_affected": "293",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64523",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64523.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.