CVE-2026-63979

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/handshake: hand off the pinned file reference to accept_doit

handshake_req_next() removes the request from the per-net

pending list and drops hn_lock before handshake_nl_accept_doit()

reads req->hr_sk->sk_socket and dereferences sock->file (once in

FD_PREPARE() and again in get_file()). In that window a

consumer running tls_handshake_cancel() followed by sockfd_put()

(svc_sock_free) or __fput_sync() (xs_reset_transport) releases

sock->file. sock_release() then runs sock_orphan(), zeroing

sk_socket, and frees the struct socket. The accept-side code

either reads NULL through sk_socket or chases freed memory.

The submit-side sock_hold() does not prevent this. sk_refcnt

protects struct sock, but struct socket and sock->file are

independently refcounted via the file descriptor the consumer

owns. Pinning sk leaves sock and sock->file unprotected.

Retarget the accept-side dereferences at req->hr_file, which was

p

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References