PT-2026-61296 · Linux · Linux

CVE-2026-63979

·

Published

2026-07-19

·

Updated

2026-07-19

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the Linux kernel, the following vulnerability has been resolved:
net/handshake: hand off the pinned file reference to accept doit
handshake req next() removes the request from the per-net pending list and drops hn lock before handshake nl accept doit() reads req->hr sk->sk socket and dereferences sock->file (once in FD PREPARE() and again in get file()). In that window a consumer running tls handshake cancel() followed by sockfd put() (svc sock free) or fput sync() (xs reset transport) releases sock->file. sock release() then runs sock orphan(), zeroing sk socket, and frees the struct socket. The accept-side code either reads NULL through sk socket or chases freed memory.
The submit-side sock hold() does not prevent this. sk refcnt protects struct sock, but struct socket and sock->file are independently refcounted via the file descriptor the consumer owns. Pinning sk leaves sock and sock->file unprotected.
Retarget the accept-side dereferences at req->hr file, which was pinned at submit time, instead of req->hr sk->sk socket->file. Pinning on its own is not sufficient: a consumer that cancels between handshake req next() returning and accept doit reaching FD PREPARE() takes the !remove pending() branch in handshake req cancel() and drops hr file before the accept side takes its own reference. Hand off an additional file reference inside handshake req next(), under hn lock, so the accept side operates on a reference that no concurrent handshake req cancel() can revoke. FD PREPARE() consumes that handed-off reference, either by transferring it to the new fd in fd publish() or by dropping it in the cleanup destructor on error; the explicit get file() that previously balanced FD PREPARE() is therefore redundant and goes away.
Update handshake req cancel test2 and test3 to simulate the FD PREPARE() consumption with an fput() so the kunit file-count assertions stay balanced.

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

CVE-2026-63979

Affected Products

Linux