CVE-2026-72221 - Vulnerability Details

- sunrpc: wait for in-flight TLS handshake callback when cancel loses race

Description

In the Linux kernel, the following vulnerability has been resolved:

sunrpc: wait for in-flight TLS handshake callback when cancel loses race

When wait_for_completion_interruptible_timeout() in
svc_tcp_handshake() returns 0 (timeout) or -ERESTARTSYS (signal) and
tls_handshake_cancel() then returns false, handshake_complete() has
won the cancellation race: it has set HANDSHAKE_F_REQ_COMPLETED and
is about to invoke svc_tcp_handshake_done(), but the callback's
side effects on xpt_flags and on svsk->sk_handshake_done have not
yet committed.

The current code reads xpt_flags immediately to decide whether the
session succeeded. Two races result.

If the callback has executed set_bit(XPT_TLS_SESSION) but not yet
clear_bit(XPT_HANDSHAKE), svc_tcp_handshake() sees a session,
enqueues the transport, and returns. svc_xprt_received() then
clears XPT_BUSY, a worker thread picks the transport up, the
dispatcher in svc_handle_xprt() observes XPT_HANDSHAKE still set,
and xpo_handshake is invoked a second time. That svc_tcp_handshake()
calls init_completion(&svsk->sk_handshake_done) while the original
callback concurrently calls complete_all() on it, corrupting the
embedded swait_queue.

If the callback has set HANDSHAKE_F_REQ_COMPLETED but not yet
entered svc_tcp_handshake_done(), svc_tcp_handshake() reads
XPT_TLS_SESSION as clear and tears the connection down even though
the handshake is about to succeed.

Wait for the callback to commit before inspecting xpt_flags. The
completion is guaranteed to fire because handshake_complete()
invokes svc_tcp_handshake_done() unconditionally once it has set
HANDSHAKE_F_REQ_COMPLETED.

Published: 2026-08-15

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A race condition exists in the Linux kernel’s Sun RPC TLS handshake path when a cancellation request races with the handshake completion callback. The callback’s completion state may not yet be visible to the handshake routine, allowing a corrupt wait queue and a premature connection tear‑down or a second handshake invocation that corrupts internal flags. The result is kernel memory corruption that can be leveraged to crash the system or disrupt services, effectively a denial of service.

Affected Systems

The vulnerability affects the Linux kernel, specifically the Sun RPC (svc_tcp) subsystem that handles TLS handshakes. No specific kernel versions are listed in the advisory, but any kernel containing the current Sun RPC implementation before the patch commit is potentially affected.

Risk and Exploitability

Because the flaw occurs in privileged kernel code and requires a race on the handshake state, it may be difficult for an attacker to reliably trigger. The CVSS score is 9.8, EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the potential for kernel memory corruption and service disruption warrants timely remediation.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`b3cbf98e2fdf3cb147a95161560cd25987284330`	affected	< 0d8ceb39884148dc7a2fdf71e1cac5961ed1d2b9
`b3cbf98e2fdf3cb147a95161560cd25987284330`	affected	< e0f4691d42a54d359d8b64509fd9ab938d4f2a33
`b3cbf98e2fdf3cb147a95161560cd25987284330`	affected	< 65b23bec1fca6e9ebdc3e6041ebf8c6ab074141b
`b3cbf98e2fdf3cb147a95161560cd25987284330`	affected	< a4f878e8ecd729ccf2e50993444e217583adeace
`b3cbf98e2fdf3cb147a95161560cd25987284330`	affected	< d00e32f84ca1a77cb67a3fbf59f58dada95f5a21

Linux

affected

Version	Status	Constraints
`6.4`	affected	—
`0`	unaffected	< 6.4
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[b3cbf98e2fdf3cb147a95161560cd25987284330,0d8ceb39884148dc7a2fdf71e1cac5961ed1d2b9)`	affected	code_commit	—
`[b3cbf98e2fdf3cb147a95161560cd25987284330,e0f4691d42a54d359d8b64509fd9ab938d4f2a33)`	affected	code_commit	—
`[b3cbf98e2fdf3cb147a95161560cd25987284330,65b23bec1fca6e9ebdc3e6041ebf8c6ab074141b)`	affected	code_commit	—
`[b3cbf98e2fdf3cb147a95161560cd25987284330,a4f878e8ecd729ccf2e50993444e217583adeace)`	affected	code_commit	—
`[b3cbf98e2fdf3cb147a95161560cd25987284330,d00e32f84ca1a77cb67a3fbf59f58dada95f5a21)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.4`	affected	generic	—
`[0,6.4)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the operating system kernel to a version containing the public patch that synchronizes the TLS handshake callback with completion detection.
Reboot the hosts after applying the kernel update to ensure the new image is active and any lingering kernel threads are restarted.
If the affected service is not required, disable Sun RPC/TCP‑based NFS or TLS transport to eliminate the attack surface until the update can be applied.

Generated by OpenCVE AI on August 22, 2026 at 07:47 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00626.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0d8ceb39884148dc7a2fdf71e1cac5961ed1d2b9
https://git.kernel.org/stable/c/65b23bec1fca6e9ebdc3e6041ebf8c6ab074141b
https://git.kernel.org/stable/c/a4f878e8ecd729ccf2e50993444e217583adeace
https://git.kernel.org/stable/c/d00e32f84ca1a77cb67a3fbf59f58dada95f5a21
https://git.kernel.org/stable/c/e0f4691d42a54d359d8b64509fd9ab938d4f2a33
https://lore.kernel.org/linux-cve-announce/2026081547-CVE-2026-72221-bbfe@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-72221
https://www.cve.org/CVERecord?id=CVE-2026-72221

History

Wed, 19 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-366
References		https://lore.kernel.org/linux-cve-announce/2026081547-CVE-2026-72221-bbfe@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-72221 https://www.cve.org/CVERecord?id=CVE-2026-72221
Metrics	threat_severity `None`	threat_severity `Important`

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 15 Aug 2026 10:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: sunrpc: wait for in-flight TLS handshake callback when cancel loses race When wait_for_completion_interruptible_timeout() in svc_tcp_handshake() returns 0 (timeout) or -ERESTARTSYS (signal) and tls_handshake_cancel() then returns false, handshake_complete() has won the cancellation race: it has set HANDSHAKE_F_REQ_COMPLETED and is about to invoke svc_tcp_handshake_done(), but the callback's side effects on xpt_flags and on svsk->sk_handshake_done have not yet committed. The current code reads xpt_flags immediately to decide whether the session succeeded. Two races result. If the callback has executed set_bit(XPT_TLS_SESSION) but not yet clear_bit(XPT_HANDSHAKE), svc_tcp_handshake() sees a session, enqueues the transport, and returns. svc_xprt_received() then clears XPT_BUSY, a worker thread picks the transport up, the dispatcher in svc_handle_xprt() observes XPT_HANDSHAKE still set, and xpo_handshake is invoked a second time. That svc_tcp_handshake() calls init_completion(&svsk->sk_handshake_done) while the original callback concurrently calls complete_all() on it, corrupting the embedded swait_queue. If the callback has set HANDSHAKE_F_REQ_COMPLETED but not yet entered svc_tcp_handshake_done(), svc_tcp_handshake() reads XPT_TLS_SESSION as clear and tears the connection down even though the handshake is about to succeed. Wait for the callback to commit before inspecting xpt_flags. The completion is guaranteed to fire because handshake_complete() invokes svc_tcp_handshake_done() unconditionally once it has set HANDSHAKE_F_REQ_COMPLETED.
Title		sunrpc: wait for in-flight TLS handshake callback when cancel loses race
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0d8ceb39884148dc7a2fdf71e1cac5961ed1d2b9 https://git.kernel.org/stable/c/65b23bec1fca6e9ebdc3e6041ebf8c6ab074141b https://git.kernel.org/stable/c/a4f878e8ecd729ccf2e50993444e217583adeace https://git.kernel.org/stable/c/d00e32f84ca1a77cb67a3fbf59f58dada95f5a21 https://git.kernel.org/stable/c/e0f4691d42a54d359d8b64509fd9ab938d4f2a33

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:54:14.539Z

Updated: 2026-08-17T05:41:42.766Z

Reserved: 2026-08-09T03:40:39.913Z

Link: CVE-2026-72221

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:21:40.990

Modified: 2026-08-17T06:18:23.160

Link: CVE-2026-72221

Redhat

Severity : Important

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72221 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-22T08:00:13Z

Weaknesses

CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
CWE-366
Race Condition within a Thread

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object