CVE-2026-63979
Received Received - Intake

Use-After-Free in Linux Kernel Handshake Mechanism

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net/handshake: hand off the pinned file reference to accept_doit handshake_req_next() removes the request from the per-net pending list and drops hn_lock before handshake_nl_accept_doit() reads req->hr_sk->sk_socket and dereferences sock->file (once in FD_PREPARE() and again in get_file()). In that window a consumer running tls_handshake_cancel() followed by sockfd_put() (svc_sock_free) or __fput_sync() (xs_reset_transport) releases sock->file. sock_release() then runs sock_orphan(), zeroing sk_socket, and frees the struct socket. The accept-side code either reads NULL through sk_socket or chases freed memory. The submit-side sock_hold() does not prevent this. sk_refcnt protects struct sock, but struct socket and sock->file are independently refcounted via the file descriptor the consumer owns. Pinning sk leaves sock and sock->file unprotected. Retarget the accept-side dereferences at req->hr_file, which was pinned at submit time, instead of req->hr_sk->sk_socket->file. Pinning on its own is not sufficient: a consumer that cancels between handshake_req_next() returning and accept_doit reaching FD_PREPARE() takes the !remove_pending() branch in handshake_req_cancel() and drops hr_file before the accept side takes its own reference. Hand off an additional file reference inside handshake_req_next(), under hn_lock, so the accept side operates on a reference that no concurrent handshake_req_cancel() can revoke. FD_PREPARE() consumes that handed-off reference, either by transferring it to the new fd in fd_publish() or by dropping it in the cleanup destructor on error; the explicit get_file() that previously balanced FD_PREPARE() is therefore redundant and goes away. Update handshake_req_cancel_test2 and _test3 to simulate the FD_PREPARE() consumption with an fput() so the kunit file-count assertions stay balanced.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63979
EUVD
EUVD-2026-45752

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in the handshake process where a pinned file reference is mishandled. The issue occurs when a consumer cancels a handshake and releases a socket file, leading to a freed memory access or NULL pointer dereference on the accept side. The fix redirects accept-side operations to use a pinned file reference instead of a socket reference, ensuring stability.

Detection Guidance

This vulnerability is specific to the Linux kernel's handshake mechanism and requires kernel-level inspection. Detection involves checking kernel logs for handshake-related errors or crashes, particularly during TLS or socket operations. Commands like dmesg | grep handshake or journalctl -k | grep handshake may reveal issues. Kernel version checks (uname -r) can confirm if your system is affected if running a vulnerable kernel version.

Impact Analysis

This vulnerability could cause system crashes, data corruption, or privilege escalation if exploited. It affects kernel networking components, potentially disrupting services relying on TLS handshakes or socket operations.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel memory safety issue unrelated to data protection or privacy controls.

Mitigation Strategies

Apply the latest kernel security patches from your Linux distribution. If patches are unavailable, consider disabling vulnerable services or modules temporarily. Monitor kernel logs for handshake-related crashes or errors. Ensure TLS handshake services are restarted after updates to apply fixes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63979. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart