CVE-2026-64523
Received Received - Intake

Linux Kernel File Reference Handling Vulnerability

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net/handshake: Take a long-lived file reference at submit handshake_nl_accept_doit() needs the file pointer backing req->hr_sk->sk_socket to survive the window between handshake_req_next() and the subsequent FD_PREPARE() and get_file(). The submit-side sock_hold() does not provide that. sk_refcnt keeps struct sock alive, but struct socket is owned by sock->file: when the consumer fputs the last file reference, sock_release() tears the socket down regardless of any sock_hold. Add an hr_file pointer to struct handshake_req and acquire an explicit reference on sock->file during handshake_req_submit(). handshake_complete() and handshake_req_cancel() release the reference on the completion-bit-winning path. The submit error path must also release the file reference, but after rhashtable insertion a concurrent handshake_req_cancel() can discover the request and race the error path. Gate the error-path cleanup -- sk_destruct restoration, fput, and request destruction -- with test_and_set_bit(HANDSHAKE_F_REQ_COMPLETED), the same serialization handshake_complete() and handshake_req_cancel() already use. When cancel has already claimed ownership, the submit error path returns without touching the request; socket teardown handles final destruction. The accept-side dereferences are not yet retargeted; that change comes in the next patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64523
EUVD
EUVD-2026-48867

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a reference management issue in the handshake subsystem. The problem occurs when a file reference is not properly maintained during socket operations, leading to potential socket teardown while the handshake request is still in use. The fix adds explicit file reference handling to prevent premature resource release.

Detection Guidance

This vulnerability is specific to the Linux kernel's handshake subsystem and requires kernel-level inspection. Detection involves checking kernel logs for handshake-related errors or monitoring for socket teardown issues during handshake operations. No direct commands are provided in the context, but monitoring for kernel panics or socket-related crashes may indicate exploitation.

Impact Analysis

This vulnerability could lead to system instability or crashes if exploited. It may cause unexpected socket closures during handshake operations, potentially disrupting network services or applications relying on socket communication.

Mitigation Strategies

Apply the latest Linux kernel patches addressing this issue. Monitor kernel logs for handshake-related errors. Ensure all network-facing services using handshake protocols are updated. If custom kernel modules are in use, review their interaction with the handshake subsystem.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64523. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart