CVE-2026-64523

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net/handshake: Take a long-lived file reference at submit

handshake_nl_accept_doit() needs the file pointer backing

req->hr_sk->sk_socket to survive the window between

handshake_req_next() and the subsequent FD_PREPARE() and get_file().

The submit-side sock_hold() does not provide that. sk_refcnt keeps

struct sock alive, but struct socket is owned by sock->file: when

the consumer fputs the last file reference, sock_release() tears

the socket down regardless of any sock_hold.

Add an hr_file pointer to struct handshake_req and acquire an

explicit reference on sock->file during handshake_req_submit().

handshake_complete() and handshake_req_cancel() release the

reference on the completion-bit-winning path.

The submit error path must also release the file reference, but

after rhashtable insertion a concurrent handshake_req_cancel() can

discover the request and race the error path. Gate the error-path

cleanup -- sk_des

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References