CVE-2026-72221

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

sunrpc: wait for in-flight TLS handshake callback when cancel loses race

When wait_for_completion_interruptible_timeout() in

svc_tcp_handshake() returns 0 (timeout) or -ERESTARTSYS (signal) and

tls_handshake_cancel() then returns false, handshake_complete() has

won the cancellation race: it has set HANDSHAKE_F_REQ_COMPLETED and

is about to invoke svc_tcp_handshake_done(), but the callback's

side effects on xpt_flags and on svsk->sk_handshake_done have not

yet committed.

The current code reads xpt_flags immediately to decide whether the

session succeeded. Two races result.

If the callback has executed set_bit(XPT_TLS_SESSION) but not yet

clear_bit(XPT_HANDSHAKE), svc_tcp_handshake() sees a session,

enqueues the transport, and returns. svc_xprt_received() then

clears XPT_BUSY, a worker thread picks the transport up, the

dispatcher in svc_handle_xprt() observes XPT_HANDSHAKE still set,

and xpo_handshake is invoked a s

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References