CVE-2026-64523 - Vulnerability Details

- net/handshake: Take a long-lived file reference at submit

Description

In the Linux kernel, the following vulnerability has been resolved:

net/handshake: Take a long-lived file reference at submit

handshake_nl_accept_doit() needs the file pointer backing
req->hr_sk->sk_socket to survive the window between
handshake_req_next() and the subsequent FD_PREPARE() and get_file().
The submit-side sock_hold() does not provide that. sk_refcnt keeps
struct sock alive, but struct socket is owned by sock->file: when
the consumer fputs the last file reference, sock_release() tears
the socket down regardless of any sock_hold.

Add an hr_file pointer to struct handshake_req and acquire an
explicit reference on sock->file during handshake_req_submit().
handshake_complete() and handshake_req_cancel() release the
reference on the completion-bit-winning path.

The submit error path must also release the file reference, but
after rhashtable insertion a concurrent handshake_req_cancel() can
discover the request and race the error path. Gate the error-path
cleanup -- sk_destruct restoration, fput, and request destruction
-- with test_and_set_bit(HANDSHAKE_F_REQ_COMPLETED), the same
serialization handshake_complete() and handshake_req_cancel()
already use. When cancel has already claimed ownership, the submit
error path returns without touching the request; socket teardown
handles final destruction.

The accept-side dereferences are not yet retargeted; that change
comes in the next patch.

Published: 2026-07-25

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw resides in the Linux kernel's network handshake handler. When a netlink handshake is submitted the code does not maintain a strong reference to the socket's file descriptor long enough to finish the handshaking, which can lead to a use‑after‑free race. This can corrupt memory and, if triggered by an attacker, can grant arbitrary code execution.

Affected Systems

All Linux kernel releases that lack the upstream patch for the net/handshake module are vulnerable. The issue appears in the core kernel code, so every distribution kernel built from upstream sources without the commit that adds an hr_file reference can be impacted.

Risk and Exploitability

The CVSS score of 9.8 marks the flaw as critical. Although the EPSS score is below 1% and it is not listed in CISA's KEV catalog, the attack surface remains high in systems that expose netlink handshake functionality to untrusted users. The race condition and use‑after‑free nature allow an attacker with privileged network access to trigger a crash or privilege escalation through a crafted netlink message.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`3b3009ea8abb713b022d94fba95ec270cf6e7eae`	affected	< 685b10dd0e32c7782cead16c8cf055c609678583
`3b3009ea8abb713b022d94fba95ec270cf6e7eae`	affected	< b913801ad9b9a51437d84d030ec6843e08976bd6
`3b3009ea8abb713b022d94fba95ec270cf6e7eae`	affected	< 16eaba5aa89c04eea125905bb8f988c1897f4f29
`3b3009ea8abb713b022d94fba95ec270cf6e7eae`	affected	< 09dba37eee70d0596e26645015f1aa95a9848e9d

Linux

affected

Version	Status	Constraints
`6.4`	affected	—
`0`	unaffected	< 6.4
`6.12.93`	unaffected	≤ 6.12.*
`6.18.44`	unaffected	≤ 6.18.*
`7.0.12`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,685b10dd0e32c7782cead16c8cf055c609678583)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,16eaba5aa89c04eea125905bb8f988c1897f4f29)`	affected	code_commit	—
`[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,09dba37eee70d0596e26645015f1aa95a9848e9d)`	affected	code_commit	—
`[0,6.12.93)`	affected	semver	—
`[0,7.0.12)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6.12.93,6.13.0)`	unaffected	semver	—
`[7.0.12,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update or rebuild the Linux kernel to the latest releases that include the net/handshake patch (the commit 09dba37… is the patch that resolves the issue).
If an immediate kernel upgrade is not feasible, isolate the affected kernel components and restrict netlink traffic from untrusted sources by using firewall rules to drop suspicious netlink handshakes; this is a temporary containment measure while the patch cannot be applied.
Enable SELinux or AppArmor policies that restrict netlink usage to trusted processes to reduce the attack surface.

Generated by OpenCVE AI on August 3, 2026 at 18:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00359.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/09dba37eee70d0596e26645015f1aa95a9848e9d
https://git.kernel.org/stable/c/16eaba5aa89c04eea125905bb8f988c1897f4f29
https://git.kernel.org/stable/c/685b10dd0e32c7782cead16c8cf055c609678583
https://git.kernel.org/stable/c/b913801ad9b9a51437d84d030ec6843e08976bd6
https://lore.kernel.org/linux-cve-announce/2026072533-CVE-2026-64523-ebb0@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64523
https://www.cve.org/CVERecord?id=CVE-2026-64523

History

Sun, 09 Aug 2026 18:45:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/b913801ad9b9a51437d84d030ec6843e08976bd6

Thu, 30 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026072533-CVE-2026-64523-ebb0@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64523 https://www.cve.org/CVERecord?id=CVE-2026-64523
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 27 Jul 2026 05:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 25 Jul 2026 10:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net/handshake: Take a long-lived file reference at submit handshake_nl_accept_doit() needs the file pointer backing req->hr_sk->sk_socket to survive the window between handshake_req_next() and the subsequent FD_PREPARE() and get_file(). The submit-side sock_hold() does not provide that. sk_refcnt keeps struct sock alive, but struct socket is owned by sock->file: when the consumer fputs the last file reference, sock_release() tears the socket down regardless of any sock_hold. Add an hr_file pointer to struct handshake_req and acquire an explicit reference on sock->file during handshake_req_submit(). handshake_complete() and handshake_req_cancel() release the reference on the completion-bit-winning path. The submit error path must also release the file reference, but after rhashtable insertion a concurrent handshake_req_cancel() can discover the request and race the error path. Gate the error-path cleanup -- sk_destruct restoration, fput, and request destruction -- with test_and_set_bit(HANDSHAKE_F_REQ_COMPLETED), the same serialization handshake_complete() and handshake_req_cancel() already use. When cancel has already claimed ownership, the submit error path returns without touching the request; socket teardown handles final destruction. The accept-side dereferences are not yet retargeted; that change comes in the next patch.
Title		net/handshake: Take a long-lived file reference at submit
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/09dba37eee70d0596e26645015f1aa95a9848e9d https://git.kernel.org/stable/c/16eaba5aa89c04eea125905bb8f988c1897f4f29 https://git.kernel.org/stable/c/685b10dd0e32c7782cead16c8cf055c609678583

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T09:20:47.606Z

Updated: 2026-08-09T18:34:58.632Z

Reserved: 2026-07-19T15:36:31.794Z

Link: CVE-2026-64523

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-07-25T10:17:38.597

Modified: 2026-08-09T19:17:02.097

Link: CVE-2026-64523

Redhat

Severity : Moderate

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64523 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-03T18:30:06Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object