net/handshake: hand off the pinned file reference to accept_doit
In the Linux kernel, the following vulnerability has been resolved: net/handshake: hand off the pinned file reference to accept_doit handshake_req_next() removes the request from the per-net pending list and drops hn_lock before handshake_nl_accept_doit() reads req->hr_sk->sk_socket and dereferences sock->file (once in FD_PREPARE() and again in get_file()). In that window a consumer running tls_handshake_cancel() followed by sockfd_put() (svc_sock_free) or __fput_sync() (xs_reset_transport) releases sock->file. sock_release() then runs sock_orphan(), zeroing sk_socket, and frees the struct socket. The accept-side code either reads NULL through sk_socket or chases freed memory. The submit-side sock_hold() does not prevent this. sk_refcnt protects struct sock, but struct socket and sock->file are independently refcounted via the file descriptor the consumer owns. Pinning sk leaves sock and sock->file unprotected. Retarget the accept-side dereferences at req->hr_file, which was pinned at submit time, instead of req->hr_sk->sk_socket->file. Pinning on its own is not sufficient: a consumer that cancels between handshake_req_next() returning and accept_doit reaching FD_PREPARE() takes the !remove_pending() branch in handshake_req_cancel() and drops hr_file before the accept side takes its own reference. Hand off an additional file reference inside handshake_req_next(), under hn_lock, so the accept side operates on a reference that no concurrent handshake_req_cancel() can revoke. FD
CVE-2026-63979
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-63979
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae",
"lessThan": "b869e3e4ce1996df23b3efdbbe9a64c4ab81d745",
"versionType": "git"
},
{
"status": "affected",
"version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae",
"lessThan": "2f28dbb30b88eafab8d49aaec94710b4e12dea8e",
"versionType": "git"
},
{
"status": "affected",
"version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae",
"lessThan": "68eba6519cbd6359fb554a9720f3a3b6b2eba23f",
"versionType": "git"
},
{
"status": "affected",
"version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae",
"lessThan": "c06876d4fac38f35820946ee3b1be7d7da799cd4",
"versionType": "git"
},
{
"status": "affected",
"version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae",
"lessThan": "f4251190e58b209999c1ba9e6d2976136a1be055",
"versionType": "git"
}
],
"programFiles": [
"net/handshake/handshake-test.c",
"net/handshake/netlink.c",
"net/handshake/request.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.4"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.4",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.44",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver",
"lessThanOrEqual": "7.0.*"
},
{
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/handshake/handshake-test.c",
"net/handshake/netlink.c",
"net/handshake/request.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-63979
Source reference:
/cveMetadata/cveId
Publisher severity
critical
Source reference: /containers/cna/metrics
- Event
- #46409 · Revision 1
- Added to Heist Feed
- Publisher date