CVE-2026-64523

What the bug is

handshake_nl_accept_doit() needs the file pointer backing req->hr_sk->sk_socket to survive the window between handshake_req_next() and the subsequent FD_PREPARE() and get_file(). The submit-side sock_hold() does not provide that. sk_refcnt keeps struct sock alive, but struct socket is owned by sock->file: when the consumer fputs the last file reference, sock_release() tears the socket down regardless of any sock_hold. Add an hr_file pointer to struct handshake_req and acquire an explicit reference on sock->file during handshake_req_submit(). handshake_complete() and handshake_req_cancel() release the reference on the completion-bit-winning path. The submit error path must also release the file reference, but after rhashtable insertion a concurrent handshake_req_cancel() can discover the request and race the error path. Gate the error-path cleanup -- sk_destruct restoration, fput, and request destruction -- with test_and_set_bit(HANDSHAKE_F_REQ_COMPLETED), the same serialization handshake_complete() and handshake_req_cancel() already use. When cancel has already claimed ownership, the submit error path returns without touching the request; socket teardown handles final destruction. The accept-side dereferences are not yet retargeted; that change comes in the next patch.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

net/handshake/handshake.h
net/handshake/netlink.c
net/handshake/request.c

What this is

HANDSHAKE UPCALL FOR TRANSPORT LAYER SECURITYMAINTAINERS section matched on net/handshake/ · kernel-tls-handshake@lists.linux.dev · Maintained

Check it on the machine

grep -w CONFIG_NET_HANDSHAKE /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

Show whether Debian builds this, per release

Debian builds this code. Every release with an answer below compiles the affected file into the kernels it ships. The build rule could not be established for 1 release, so nothing is claimed about those.

• bookworm?
• trixie, forky, sidy

?

not established - no Makefile entry for the affected file

y

built into the kernel image on every flavour - only a patch removes it

Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.

Build switch

CONFIG_NET_HANDSHAKE

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Signals

Published

2026-07-25 (3 months ago)source

CVSS

9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it

Attack vector

network (AV:N)source

EPSS

0.67%, higher than 51.1% of all CVEssource

CISA KEV

not listedthe KEV catalogue

Debian urgency

unimportantsource

Subsystem

net/handshake

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
6.4	6.12.93	685b10dd0e32
6.4	6.18.44	b913801ad9b9
6.4	7.0.12	16eaba5aa89c
6.4	7.1	09dba37eee70