GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-63979 (GCVE-0-2026-63979)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:56 – Updated: 2026-08-09 18:34
VLAI
Title
net/handshake: hand off the pinned file reference to accept_doit
Summary
In the Linux kernel, the following vulnerability has been resolved: net/handshake: hand off the pinned file reference to accept_doit handshake_req_next() removes the request from the per-net pending list and drops hn_lock before handshake_nl_accept_doit() reads req->hr_sk->sk_socket and dereferences sock->file (once in FD_PREPARE() and again in get_file()). In that window a consumer running tls_handshake_cancel() followed by sockfd_put() (svc_sock_free) or __fput_sync() (xs_reset_transport) releases sock->file. sock_release() then runs sock_orphan(), zeroing sk_socket, and frees the struct socket. The accept-side code either reads NULL through sk_socket or chases freed memory. The submit-side sock_hold() does not prevent this. sk_refcnt protects struct sock, but struct socket and sock->file are independently refcounted via the file descriptor the consumer owns. Pinning sk leaves sock and sock->file unprotected. Retarget the accept-side dereferences at req->hr_file, which was pinned at submit time, instead of req->hr_sk->sk_socket->file. Pinning on its own is not sufficient: a consumer that cancels between handshake_req_next() returning and accept_doit reaching FD_PREPARE() takes the !remove_pending() branch in handshake_req_cancel() and drops hr_file before the accept side takes its own reference. Hand off an additional file reference inside handshake_req_next(), under hn_lock, so the accept side operates on a reference that no concurrent handshake_req_cancel() can revoke. FD_PREPARE() consumes that handed-off reference, either by transferring it to the new fd in fd_publish() or by dropping it in the cleanup destructor on error; the explicit get_file() that previously balanced FD_PREPARE() is therefore redundant and goes away. Update handshake_req_cancel_test2 and _test3 to simulate the FD_PREPARE() consumption with an fput() so the kunit file-count assertions stay balanced.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 3b3009ea8abb713b022d94fba95ec270cf6e7eae , < 68eba6519cbd6359fb554a9720f3a3b6b2eba23f (git)
Affected: 3b3009ea8abb713b022d94fba95ec270cf6e7eae , < c06876d4fac38f35820946ee3b1be7d7da799cd4 (git)
Affected: 3b3009ea8abb713b022d94fba95ec270cf6e7eae , < f4251190e58b209999c1ba9e6d2976136a1be055 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.4
Unaffected: 0 , < 6.4 (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.0.12 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/handshake/handshake-test.c",
            "net/handshake/netlink.c",
            "net/handshake/request.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "68eba6519cbd6359fb554a9720f3a3b6b2eba23f",
              "status": "affected",
              "version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae",
              "versionType": "git"
            },
            {
              "lessThan": "c06876d4fac38f35820946ee3b1be7d7da799cd4",
              "status": "affected",
              "version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae",
              "versionType": "git"
            },
            {
              "lessThan": "f4251190e58b209999c1ba9e6d2976136a1be055",
              "status": "affected",
              "version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/handshake/handshake-test.c",
            "net/handshake/netlink.c",
            "net/handshake/request.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/handshake: hand off the pinned file reference to accept_doit\n\nhandshake_req_next() removes the request from the per-net\npending list and drops hn_lock before handshake_nl_accept_doit()\nreads req-\u003ehr_sk-\u003esk_socket and dereferences sock-\u003efile (once in\nFD_PREPARE() and again in get_file()).  In that window a\nconsumer running tls_handshake_cancel() followed by sockfd_put()\n(svc_sock_free) or __fput_sync() (xs_reset_transport) releases\nsock-\u003efile.  sock_release() then runs sock_orphan(), zeroing\nsk_socket, and frees the struct socket.  The accept-side code\neither reads NULL through sk_socket or chases freed memory.\n\nThe submit-side sock_hold() does not prevent this.  sk_refcnt\nprotects struct sock, but struct socket and sock-\u003efile are\nindependently refcounted via the file descriptor the consumer\nowns.  Pinning sk leaves sock and sock-\u003efile unprotected.\n\nRetarget the accept-side dereferences at req-\u003ehr_file, which was\npinned at submit time, instead of req-\u003ehr_sk-\u003esk_socket-\u003efile.\nPinning on its own is not sufficient: a consumer that cancels\nbetween handshake_req_next() returning and accept_doit reaching\nFD_PREPARE() takes the !remove_pending() branch in\nhandshake_req_cancel() and drops hr_file before the accept side\ntakes its own reference.  Hand off an additional file reference\ninside handshake_req_next(), under hn_lock, so the accept side\noperates on a reference that no concurrent handshake_req_cancel()\ncan revoke.  FD_PREPARE() consumes that handed-off reference,\neither by transferring it to the new fd in fd_publish() or by\ndropping it in the cleanup destructor on error; the explicit\nget_file() that previously balanced FD_PREPARE() is therefore\nredundant and goes away.\n\nUpdate handshake_req_cancel_test2 and _test3 to simulate the\nFD_PREPARE() consumption with an fput() so the kunit file-count\nassertions stay balanced."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The race is triggered by remote TLS handshake activity on network-facing kernel consumers (nfsd RPC-over-TLS STARTTLS probe, NVMe-oTCP TLS13 connections). A remote peer can initiate handshake_req_submit() and force cancellation via disconnect, while tlshd automatically issues HANDSHAKE_CMD_ACCEPT in response to kernel notifications.\nAC:L - The attacker controls both sides of the race by opening TLS connections and timing disconnects or aborts against tlshd accept processing. Repeated parallel connection attempts make winning the window between handshake_req_next() and FD_PREPARE() practical without conditions outside attacker control.\nPR:N - Exploitation requires no credentials on the target server. NFS RPC_AUTH_TLS uses a NULL-procedure STARTTLS probe before any RPC authentication, and NVMe-oTCP TLS handshakes run at initial connection setup prior to namespace authentication.\nUI:N - No victim interaction is required. The tlshd daemon automatically accepts pending handshake requests upon receiving HANDSHAKE_CMD_READY multicast notifications; the attacker only needs to manipulate connection timing over the network.\nS:U - The vulnerability corrupts kernel heap memory (struct socket/file UAF or NULL dereference through sk_socket) within the kernel\u0027s security authority. It does not cross a VM, container, or IOMMU security boundary.\nC:H - The accept path dereferences sock-\u003efile after sock_release() may free the struct socket and sock_orphan() zeroes sk_socket, constituting a use-after-free. UAF of socket/file structures can be leveraged for arbitrary kernel memory disclosure via heap grooming.\nI:H - Use-after-free of the pinned socket file object provides a foundation for heap spraying and arbitrary write primitives to hijack kernel control flow, not merely a bounded or transient modification.\nA:H - The bug manifests as either a NULL pointer dereference through zeroed sk_socket or chasing freed socket memory in FD_PREPARE()/get_file(), both of which cause kernel oops or panic and deny service to the affected host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-09T18:34:56.283Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/68eba6519cbd6359fb554a9720f3a3b6b2eba23f"
        },
        {
          "url": "https://git.kernel.org/stable/c/c06876d4fac38f35820946ee3b1be7d7da799cd4"
        },
        {
          "url": "https://git.kernel.org/stable/c/f4251190e58b209999c1ba9e6d2976136a1be055"
        }
      ],
      "title": "net/handshake: hand off the pinned file reference to accept_doit",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63979",
    "datePublished": "2026-07-19T14:56:03.177Z",
    "dateReserved": "2026-07-19T07:54:57.025Z",
    "dateUpdated": "2026-08-09T18:34:56.283Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63979",
      "date": "2026-09-04",
      "epss": "0.00614",
      "percentile": "0.47132"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-13T00:05:54.000Z",
      "cve": "CVE-2026-63979",
      "id": "msrc_CVE-2026-63979",
      "initial_release_date": "2026-07-21T01:04:40.000Z",
      "product_status:known_affected": "1",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net/handshake: hand off the pinned file reference to accept_doit",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-63979.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-63979\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-19T16:17:17.070\",\"lastModified\":\"2026-08-09T19:17:01.833\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/handshake: hand off the pinned file reference to accept_doit\\n\\nhandshake_req_next() removes the request from the per-net\\npending list and drops hn_lock before handshake_nl_accept_doit()\\nreads req-\u003ehr_sk-\u003esk_socket and dereferences sock-\u003efile (once in\\nFD_PREPARE() and again in get_file()).  In that window a\\nconsumer running tls_handshake_cancel() followed by sockfd_put()\\n(svc_sock_free) or __fput_sync() (xs_reset_transport) releases\\nsock-\u003efile.  sock_release() then runs sock_orphan(), zeroing\\nsk_socket, and frees the struct socket.  The accept-side code\\neither reads NULL through sk_socket or chases freed memory.\\n\\nThe submit-side sock_hold() does not prevent this.  sk_refcnt\\nprotects struct sock, but struct socket and sock-\u003efile are\\nindependently refcounted via the file descriptor the consumer\\nowns.  Pinning sk leaves sock and sock-\u003efile unprotected.\\n\\nRetarget the accept-side dereferences at req-\u003ehr_file, which was\\npinned at submit time, instead of req-\u003ehr_sk-\u003esk_socket-\u003efile.\\nPinning on its own is not sufficient: a consumer that cancels\\nbetween handshake_req_next() returning and accept_doit reaching\\nFD_PREPARE() takes the !remove_pending() branch in\\nhandshake_req_cancel() and drops hr_file before the accept side\\ntakes its own reference.  Hand off an additional file reference\\ninside handshake_req_next(), under hn_lock, so the accept side\\noperates on a reference that no concurrent handshake_req_cancel()\\ncan revoke.  FD_PREPARE() consumes that handed-off reference,\\neither by transferring it to the new fd in fd_publish() or by\\ndropping it in the cleanup destructor on error; the explicit\\nget_file() that previously balanced FD_PREPARE() is therefore\\nredundant and goes away.\\n\\nUpdate handshake_req_cancel_test2 and _test3 to simulate the\\nFD_PREPARE() consumption with an fput() so the kunit file-count\\nassertions stay balanced.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/handshake/handshake-test.c\",\"net/handshake/netlink.c\",\"net/handshake/request.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3b3009ea8abb713b022d94fba95ec270cf6e7eae\",\"lessThan\":\"68eba6519cbd6359fb554a9720f3a3b6b2eba23f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3b3009ea8abb713b022d94fba95ec270cf6e7eae\",\"lessThan\":\"c06876d4fac38f35820946ee3b1be7d7da799cd4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3b3009ea8abb713b022d94fba95ec270cf6e7eae\",\"lessThan\":\"f4251190e58b209999c1ba9e6d2976136a1be055\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/handshake/handshake-test.c\",\"net/handshake/netlink.c\",\"net/handshake/request.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.44\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.12\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/68eba6519cbd6359fb554a9720f3a3b6b2eba23f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c06876d4fac38f35820946ee3b1be7d7da799cd4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f4251190e58b209999c1ba9e6d2976136a1be055\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T14:20:55+00:00",
      "cve": "CVE-2026-63979",
      "id": "CVE-2026-63979",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/handshake: hand off the pinned file reference to accept_doit",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63979.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.