CVE-2026-63979

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-63979", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.025Z", "datePublished": "2026-07-19T14:56:03.177Z", "dateUpdated": "2026-10-21T12:42:50.338Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:42:50.338Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/handshake: hand off the pinned file reference to accept_doit\n\nhandshake_req_next() removes the request from the per-net\npending list and drops hn_lock before handshake_nl_accept_doit()\nreads req->hr_sk->sk_socket and dereferences sock->file (once in\nFD_PREPARE() and again in get_file()). In that window a\nconsumer running tls_handshake_cancel() followed by sockfd_put()\n(svc_sock_free) or __fput_sync() (xs_reset_transport) releases\nsock->file. sock_release() then runs sock_orphan(), zeroing\nsk_socket, and frees the struct socket. The accept-side code\neither reads NULL through sk_socket or chases freed memory.\n\nThe submit-side sock_hold() does not prevent this. sk_refcnt\nprotects struct sock, but struct socket and sock->file are\nindependently refcounted via the file descriptor the consumer\nowns. Pinning sk leaves sock and sock->file unprotected.\n\nRetarget the accept-side dereferences at req->hr_file, which was\npinned at submit time, instead of req->hr_sk->sk_socket->file.\nPinning on its own is not sufficient: a consumer that cancels\nbetween handshake_req_next() returning and accept_doit reaching\nFD_PREPARE() takes the !remove_pending() branch in\nhandshake_req_cancel() and drops hr_file before the accept side\ntakes its own reference. Hand off an additional file reference\ninside handshake_req_next(), under hn_lock, so the accept side\noperates on a reference that no concurrent handshake_req_cancel()\ncan revoke. FD_PREPARE() consumes that handed-off reference,\neither by transferring it to the new fd in fd_publish() or by\ndropping it in the cleanup destructor on error; the explicit\nget_file() that previously balanced FD_PREPARE() is therefore\nredundant and goes away.\n\nUpdate handshake_req_cancel_test2 and _test3 to simulate the\nFD_PREPARE() consumption with an fput() so the kunit file-count\nassertions stay balanced."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The race is triggered by remote TLS handshake activity on network-facing kernel consumers (nfsd RPC-over-TLS STARTTLS probe, NVMe-oTCP TLS13 connections). A remote peer can initiate handshake_req_submit() and force cancellation via disconnect, while tlshd automatically issues HANDSHAKE_CMD_ACCEPT in response to kernel notifications.\nAC:L - The attacker controls both sides of the race by opening TLS connections and timing disconnects or aborts against tlshd accept processing. Repeated parallel connection attempts make winning the window between handshake_req_next() and FD_PREPARE() practical without conditions outside attacker control.\nPR:N - Exploitation requires no credentials on the target server. NFS RPC_AUTH_TLS uses a NULL-procedure STARTTLS probe before any RPC authentication, and NVMe-oTCP TLS handshakes run at initial connection setup prior to namespace authentication.\nUI:N - No victim interaction is required. The tlshd daemon automatically accepts pending handshake requests upon receiving HANDSHAKE_CMD_READY multicast notifications; the attacker only needs to manipulate connection timing over the network.\nS:U - The vulnerability corrupts kernel heap memory (struct socket/file UAF or NULL dereference through sk_socket) within the kernel's security authority. It does not cross a VM, container, or IOMMU security boundary.\nC:H - The accept path dereferences sock->file after sock_release() may free the struct socket and sock_orphan() zeroes sk_socket, constituting a use-after-free. UAF of socket/file structures can be leveraged for arbitrary kernel memory disclosure via heap grooming.\nI:H - Use-after-free of the pinned socket file object provides a foundation for heap spraying and arbitrary write primitives to hijack kernel control flow, not merely a bounded or transient modification.\nA:H - The bug manifests as either a NULL pointer dereference through zeroed sk_socket or chasing freed socket memory in FD_PREPARE()/get_file(), both of which cause kernel oops or panic and deny service to the affected host."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/handshake/handshake-test.c", "net/handshake/netlink.c", "net/handshake/request.c"], "versions": [{"version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae", "lessThan": "b869e3e4ce1996df23b3efdbbe9a64c4ab81d745", "status": "affected", "versionType": "git"}, {"version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae", "lessThan": "2f28dbb30b88eafab8d49aaec94710b4e12dea8e", "status": "affected", "versionType": "git"}, {"version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae", "lessThan": "68eba6519cbd6359fb554a9720f3a3b6b2eba23f", "status": "affected", "versionType": "git"}, {"version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae", "lessThan": "c06876d4fac38f35820946ee3b1be7d7da799cd4", "status": "affected", "versionType": "git"}, {"version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae", "lessThan": "f4251190e58b209999c1ba9e6d2976136a1be055", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/handshake/handshake-test.c", "net/handshake/netlink.c", "net/handshake/request.c"], "versions": [{"version": "6.4", "status": "affected"}, {"version": "0", "lessThan": "6.4", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.44", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.12", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.6.160"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "6.18.44"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "7.0.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.4", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/b869e3e4ce1996df23b3efdbbe9a64c4ab81d745"}, {"url": "https://git.kernel.org/stable/c/2f28dbb30b88eafab8d49aaec94710b4e12dea8e"}, {"url": "https://git.kernel.org/stable/c/68eba6519cbd6359fb554a9720f3a3b6b2eba23f"}, {"url": "https://git.kernel.org/stable/c/c06876d4fac38f35820946ee3b1be7d7da799cd4"}, {"url": "https://git.kernel.org/stable/c/f4251190e58b209999c1ba9e6d2976136a1be055"}], "title": "net/handshake: hand off the pinned file reference to accept_doit", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63979", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:34:33.675009Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T20:18:00.491Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-63979", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:34:33.675009Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-416", "description": "CWE-416 Use After Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:34:34.571Z"}}], "cna": {"title": "net/handshake: hand off the pinned file reference to accept_doit", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The race is triggered by remote TLS handshake activity on network-facing kernel consumers (nfsd RPC-over-TLS STARTTLS probe, NVMe-oTCP TLS13 connections). A remote peer can initiate handshake_req_submit() and force cancellation via disconnect, while tlshd automatically issues HANDSHAKE_CMD_ACCEPT in response to kernel notifications.\nAC:L - The attacker controls both sides of the race by opening TLS connections and timing disconnects or aborts against tlshd accept processing. Repeated parallel connection attempts make winning the window between handshake_req_next() and FD_PREPARE() practical without conditions outside attacker control.\nPR:N - Exploitation requires no credentials on the target server. NFS RPC_AUTH_TLS uses a NULL-procedure STARTTLS probe before any RPC authentication, and NVMe-oTCP TLS handshakes run at initial connection setup prior to namespace authentication.\nUI:N - No victim interaction is required. The tlshd daemon automatically accepts pending handshake requests upon receiving HANDSHAKE_CMD_READY multicast notifications; the attacker only needs to manipulate connection timing over the network.\nS:U - The vulnerability corrupts kernel heap memory (struct socket/file UAF or NULL dereference through sk_socket) within the kernel's security authority. It does not cross a VM, container, or IOMMU security boundary.\nC:H - The accept path dereferences sock->file after sock_release() may free the struct socket and sock_orphan() zeroes sk_socket, constituting a use-after-free. UAF of socket/file structures can be leveraged for arbitrary kernel memory disclosure via heap grooming.\nI:H - Use-after-free of the pinned socket file object provides a foundation for heap spraying and arbitrary write primitives to hijack kernel control flow, not merely a bounded or transient modification.\nA:H - The bug manifests as either a NULL pointer dereference through zeroed sk_socket or chasing freed socket memory in FD_PREPARE()/get_file(), both of which cause kernel oops or panic and deny service to the affected host."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae", "lessThan": "b869e3e4ce1996df23b3efdbbe9a64c4ab81d745", "versionType": "git"}, {"status": "affected", "version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae", "lessThan": "2f28dbb30b88eafab8d49aaec94710b4e12dea8e", "versionType": "git"}, {"status": "affected", "version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae", "lessThan": "68eba6519cbd6359fb554a9720f3a3b6b2eba23f", "versionType": "git"}, {"status": "affected", "version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae", "lessThan": "c06876d4fac38f35820946ee3b1be7d7da799cd4", "versionType": "git"}, {"status": "affected", "version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae", "lessThan": "f4251190e58b209999c1ba9e6d2976136a1be055", "versionType": "git"}], "programFiles": ["net/handshake/handshake-test.c", "net/handshake/netlink.c", "net/handshake/request.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.4"}, {"status": "unaffected", "version": "0", "lessThan": "6.4", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.160", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.114", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.44", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.12", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/handshake/handshake-test.c", "net/handshake/netlink.c", "net/handshake/request.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/b869e3e4ce1996df23b3efdbbe9a64c4ab81d745"}, {"url": "https://git.kernel.org/stable/c/2f28dbb30b88eafab8d49aaec94710b4e12dea8e"}, {"url": "https://git.kernel.org/stable/c/68eba6519cbd6359fb554a9720f3a3b6b2eba23f"}, {"url": "https://git.kernel.org/stable/c/c06876d4fac38f35820946ee3b1be7d7da799cd4"}, {"url": "https://git.kernel.org/stable/c/f4251190e58b209999c1ba9e6d2976136a1be055"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/handshake: hand off the pinned file reference to accept_doit\n\nhandshake_req_next() removes the request from the per-net\npending list and drops hn_lock before handshake_nl_accept_doit()\nreads req->hr_sk->sk_socket and dereferences sock->file (once in\nFD_PREPARE() and again in get_file()). In that window a\nconsumer running tls_handshake_cancel() followed by sockfd_put()\n(svc_sock_free) or __fput_sync() (xs_reset_transport) releases\nsock->file. sock_release() then runs sock_orphan(), zeroing\nsk_socket, and frees the struct socket. The accept-side code\neither reads NULL through sk_socket or chases freed memory.\n\nThe submit-side sock_hold() does not prevent this. sk_refcnt\nprotects struct sock, but struct socket and sock->file are\nindependently refcounted via the file descriptor the consumer\nowns. Pinning sk leaves sock and sock->file unprotected.\n\nRetarget the accept-side dereferences at req->hr_file, which was\npinned at submit time, instead of req->hr_sk->sk_socket->file.\nPinning on its own is not sufficient: a consumer that cancels\nbetween handshake_req_next() returning and accept_doit reaching\nFD_PREPARE() takes the !remove_pending() branch in\nhandshake_req_cancel() and drops hr_file before the accept side\ntakes its own reference. Hand off an additional file reference\ninside handshake_req_next(), under hn_lock, so the accept side\noperates on a reference that no concurrent handshake_req_cancel()\ncan revoke. FD_PREPARE() consumes that handed-off reference,\neither by transferring it to the new fd in fd_publish() or by\ndropping it in the cleanup destructor on error; the explicit\nget_file() that previously balanced FD_PREPARE() is therefore\nredundant and goes away.\n\nUpdate handshake_req_cancel_test2 and _test3 to simulate the\nFD_PREPARE() consumption with an fput() so the kunit file-count\nassertions stay balanced."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.160", "versionStartIncluding": "6.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.114", "versionStartIncluding": "6.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.44", "versionStartIncluding": "6.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.12", "versionStartIncluding": "6.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "6.4"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:42:50.338Z"}}}, "cveMetadata": {"cveId": "CVE-2026-63979", "state": "PUBLISHED", "dateUpdated": "2026-10-21T12:42:50.338Z", "dateReserved": "2026-07-19T07:54:57.025Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-07-19T14:56:03.177Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/handshake/handshake-test.c", "net/handshake/netlink.c", "net/handshake/request.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "b869e3e4ce1996df23b3efdbbe9a64c4ab81d745", "status": "affected", "version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae", "versionType": "git"}, {"lessThan": "2f28dbb30b88eafab8d49aaec94710b4e12dea8e", "status": "affected", "version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae", "versionType": "git"}, {"lessThan": "68eba6519cbd6359fb554a9720f3a3b6b2eba23f", "status": "affected", "version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae", "versionType": "git"}, {"lessThan": "c06876d4fac38f35820946ee3b1be7d7da799cd4", "status": "affected", "version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae", "versionType": "git"}, {"lessThan": "f4251190e58b209999c1ba9e6d2976136a1be055", "status": "affected", "version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/handshake/handshake-test.c", "net/handshake/netlink.c", "net/handshake/request.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.4"}, {"lessThan": "6.4", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.160", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.44", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.12", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "54397279-D47C-4BF4-9212-AB36CC8762B1", "versionEndExcluding": "6.6.160", "versionStartIncluding": "6.4", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E6209C78-7745-495E-92DC-3CD950D149EE", "versionEndExcluding": "6.12.114", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "CBC7A6FB-993F-4125-9FCD-DEC6EC80FA78", "versionEndExcluding": "6.18.44", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9161A938-0FA8-44BC-95FE-C5A271601AB3", "versionEndExcluding": "7.0.12", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*", "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/handshake: hand off the pinned file reference to accept_doit\n\nhandshake_req_next() removes the request from the per-net\npending list and drops hn_lock before handshake_nl_accept_doit()\nreads req->hr_sk->sk_socket and dereferences sock->file (once in\nFD_PREPARE() and again in get_file()). In that window a\nconsumer running tls_handshake_cancel() followed by sockfd_put()\n(svc_sock_free) or __fput_sync() (xs_reset_transport) releases\nsock->file. sock_release() then runs sock_orphan(), zeroing\nsk_socket, and frees the struct socket. The accept-side code\neither reads NULL through sk_socket or chases freed memory.\n\nThe submit-side sock_hold() does not prevent this. sk_refcnt\nprotects struct sock, but struct socket and sock->file are\nindependently refcounted via the file descriptor the consumer\nowns. Pinning sk leaves sock and sock->file unprotected.\n\nRetarget the accept-side dereferences at req->hr_file, which was\npinned at submit time, instead of req->hr_sk->sk_socket->file.\nPinning on its own is not sufficient: a consumer that cancels\nbetween handshake_req_next() returning and accept_doit reaching\nFD_PREPARE() takes the !remove_pending() branch in\nhandshake_req_cancel() and drops hr_file before the accept side\ntakes its own reference. Hand off an additional file reference\ninside handshake_req_next(), under hn_lock, so the accept side\noperates on a reference that no concurrent handshake_req_cancel()\ncan revoke. FD_PREPARE() consumes that handed-off reference,\neither by transferring it to the new fd in fd_publish() or by\ndropping it in the cleanup destructor on error; the explicit\nget_file() that previously balanced FD_PREPARE() is therefore\nredundant and goes away.\n\nUpdate handshake_req_cancel_test2 and _test3 to simulate the\nFD_PREPARE() consumption with an fput() so the kunit file-count\nassertions stay balanced."}], "id": "CVE-2026-63979", "lastModified": "2026-11-12T18:46:29.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-63979", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:34:33.675009Z", "version": "2.0.3"}}]}, "published": "2026-07-19T16:17:17.070", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2f28dbb30b88eafab8d49aaec94710b4e12dea8e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/68eba6519cbd6359fb554a9720f3a3b6b2eba23f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/b869e3e4ce1996df23b3efdbbe9a64c4ab81d745"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/c06876d4fac38f35820946ee3b1be7d7da799cd4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f4251190e58b209999c1ba9e6d2976136a1be055"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: net/handshake: hand off the pinned file reference to accept_doit", "id": "2502376", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502376"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet/handshake: hand off the pinned file reference to accept_doit\nhandshake_req_next() removes the request from the per-net\npending list and drops hn_lock before handshake_nl_accept_doit()\nreads req->hr_sk->sk_socket and dereferences sock->file (once in\nFD_PREPARE() and again in get_file()). In that window a\nconsumer running tls_handshake_cancel() followed by sockfd_put()\n(svc_sock_free) or __fput_sync() (xs_reset_transport) releases\nsock->file. sock_release() then runs sock_orphan(), zeroing\nsk_socket, and frees the struct socket. The accept-side code\neither reads NULL through sk_socket or chases freed memory.\nThe submit-side sock_hold() does not prevent this. sk_refcnt\nprotects struct sock, but struct socket and sock->file are\nindependently refcounted via the file descriptor the consumer\nowns. Pinning sk leaves sock and sock->file unprotected.\nRetarget the accept-side dereferences at req->hr_file, which was\npinned at submit time, instead of req->hr_sk->sk_socket->file.\nPinning on its own is not sufficient: a consumer that cancels\nbetween handshake_req_next() returning and accept_doit reaching\nFD_PREPARE() takes the !remove_pending() branch in\nhandshake_req_cancel() and drops hr_file before the accept side\ntakes its own reference. Hand off an additional file reference\ninside handshake_req_next(), under hn_lock, so the accept side\noperates on a reference that no concurrent handshake_req_cancel()\ncan revoke. FD_PREPARE() consumes that handed-off reference,\neither by transferring it to the new fd in fd_publish() or by\ndropping it in the cleanup destructor on error; the explicit\nget_file() that previously balanced FD_PREPARE() is therefore\nredundant and goes away.\nUpdate handshake_req_cancel_test2 and _test3 to simulate the\nFD_PREPARE() consumption with an fput() so the kunit file-count\nassertions stay balanced.", "A flaw was found in the Linux kernel's `net/handshake` component. A race condition exists where a network handshake request can be removed and its associated file reference released concurrently while the accept-side code attempts to access it. This can lead to the system attempting to read from freed memory or a null pointer, potentially causing system instability or a denial of service."], "name": "CVE-2026-63979", "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-63979\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63979\nhttps://lore.kernel.org/linux-cve-announce/2026071901-CVE-2026-63979-85c4@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3b3009ea8abb713b022d94fba95ec270cf6e7eae,c06876d4fac38f35820946ee3b1be7d7da799cd4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[3b3009ea8abb713b022d94fba95ec270cf6e7eae,f4251190e58b209999c1ba9e6d2976136a1be055)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.4"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.4)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.12,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-22T01:15:13.049563+00:00", "updated": "2026-10-20T03:30:08.097122+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-416", "CWE-825"]}