CVE-2026-72222 - Vulnerability Details

- sunrpc: pin svc_xprt across the asynchronous TLS handshake callback

Description

In the Linux kernel, the following vulnerability has been resolved:

sunrpc: pin svc_xprt across the asynchronous TLS handshake callback

svc_tcp_handshake() stores the raw svc_xprt pointer in
tls_handshake_args.ta_data and submits the request through
tls_server_hello_x509(). The handshake core takes only
sock_hold(req->hr_sk); nothing references the embedding struct
svc_sock that svc_tcp_handshake_done() reaches via container_of().

Two close races leave the in-flight callback writing through a freed
svc_sock. svc_sock_free() calls tls_handshake_cancel() and discards
its return value: a false return means handshake_complete() has
already set HANDSHAKE_F_REQ_COMPLETED but hp_done() may not have
finished, yet svc_sock_free() proceeds to kfree(svsk). The
cancel-loser fall-through inside svc_tcp_handshake() itself produces
the same window: when wait_for_completion_interruptible_timeout()
returns <= 0 (timeout or signal) and tls_handshake_cancel() returns
false, the function does not drain, returns, and svc_handle_xprt()
calls svc_xprt_received(), which clears XPT_BUSY and can drop the
last reference. A concurrent close then runs svc_sock_free() while
svc_tcp_handshake_done() is still updating xpt_flags and walking
svsk->sk_handshake_done.

The corruption surfaces as set_bit/clear_bit RMW into the freed
xpt_flags slab slot and as complete_all() walking and writing the
freed wait_queue_head_t list embedded in sk_handshake_done -- a
slab-corruption primitive, not a benign read. The path is reachable
on any TLS-enabled NFS server whenever a connection close overlaps
the tlshd downcall delivery window; the interruptible wait means
signal delivery suffices, not just SVC_HANDSHAKE_TO expiry.

Take svc_xprt_get(xprt) immediately before tls_server_hello_x509()
so the in-flight callback owns its own reference. Release it on the
two edges where the callback is guaranteed not to fire -- submission
failure from tls_server_hello_x509() and a successful
tls_handshake_cancel() -- and at the tail of
svc_tcp_handshake_done() after complete_all().

[cel: rewrote commit message to describe the actual change]

Published: 2026-08-15

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel contains a race condition between the asynchronous TLS handshake callback and the closing of an NFS server socket. When a connection is closed during the handshaking window, the callback may write through a freed svc_sock structure, corrupting memory slabs and potentially enabling an attacker to execute arbitrary code with kernel privileges. This vulnerability is a classic use‑after‑free flaw (CWE‑416).

Affected Systems

All Linux kernel releases that contain the old sunrpc TLS handshake implementation are affected. The issue appears on any TLS‑enabled NFS server where a client close can overlap the handshaking callback duration. Because the vendor list is simply Linux:Linux, the impact is on the Linux kernel itself, but the specific vulnerable revisions are not enumerated in the current data.

Risk and Exploitability

The CVSS score for this vulnerability is 9.8, indicating a critical risk. The EPSS score is less than 1%, suggesting a low but nonzero exploitation probability. The flaw does not require special privileges and can be triggered through a normal NFS client over the network, making it a remote attack vector. The vulnerability is not listed in the CISA KEV catalog, but given the potential for kernel exploitation it should still be treated as high risk for affected systems.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`b3cbf98e2fdf3cb147a95161560cd25987284330`	affected	< f3b55945dd99f29d83e1965d0141040a35262346
`b3cbf98e2fdf3cb147a95161560cd25987284330`	affected	< 2d4f97d13fff91e0bc539216be88b884b544d49f
`b3cbf98e2fdf3cb147a95161560cd25987284330`	affected	< 3f9ee75a97a769be258784c22b89657acb5ed9bd
`b3cbf98e2fdf3cb147a95161560cd25987284330`	affected	< 083e9c2ec7e8bb13b79c9fd7b337abdd758ecc5f
`b3cbf98e2fdf3cb147a95161560cd25987284330`	affected	< 4f988f3a2808fb659f3880c282041ff067acad78

Linux

affected

Version	Status	Constraints
`6.4`	affected	—
`0`	unaffected	< 6.4
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[b3cbf98e2fdf3cb147a95161560cd25987284330,f3b55945dd99f29d83e1965d0141040a35262346)`	affected	code_commit	—
`[b3cbf98e2fdf3cb147a95161560cd25987284330,2d4f97d13fff91e0bc539216be88b884b544d49f)`	affected	code_commit	—
`[b3cbf98e2fdf3cb147a95161560cd25987284330,3f9ee75a97a769be258784c22b89657acb5ed9bd)`	affected	code_commit	—
`[b3cbf98e2fdf3cb147a95161560cd25987284330,083e9c2ec7e8bb13b79c9fd7b337abdd758ecc5f)`	affected	code_commit	—
`[b3cbf98e2fdf3cb147a95161560cd25987284330,4f988f3a2808fb659f3880c282041ff067acad78)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.4`	affected	semver	—
`[0,6.4)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update to the latest Linux kernel that incorporates the fix (commit 083e9c2ec7e8bb13b79c9fd7b337abdd758ecc5f or later).
If an update is not yet possible, temporarily disable TLS for NFS services or shut down the NFS server until the patch is applied.
Continuously monitor security advisories and update the kernel when a suitable release becomes available.

Generated by OpenCVE AI on August 22, 2026 at 07:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00618.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/083e9c2ec7e8bb13b79c9fd7b337abdd758ecc5f
https://git.kernel.org/stable/c/2d4f97d13fff91e0bc539216be88b884b544d49f
https://git.kernel.org/stable/c/3f9ee75a97a769be258784c22b89657acb5ed9bd
https://git.kernel.org/stable/c/4f988f3a2808fb659f3880c282041ff067acad78
https://git.kernel.org/stable/c/f3b55945dd99f29d83e1965d0141040a35262346
https://lore.kernel.org/linux-cve-announce/2026081547-CVE-2026-72222-8ff1@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-72222
https://www.cve.org/CVERecord?id=CVE-2026-72222

History

Wed, 19 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026081547-CVE-2026-72222-8ff1@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-72222 https://www.cve.org/CVERecord?id=CVE-2026-72222
Metrics	threat_severity `None`	threat_severity `Important`

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 15 Aug 2026 10:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback svc_tcp_handshake() stores the raw svc_xprt pointer in tls_handshake_args.ta_data and submits the request through tls_server_hello_x509(). The handshake core takes only sock_hold(req->hr_sk); nothing references the embedding struct svc_sock that svc_tcp_handshake_done() reaches via container_of(). Two close races leave the in-flight callback writing through a freed svc_sock. svc_sock_free() calls tls_handshake_cancel() and discards its return value: a false return means handshake_complete() has already set HANDSHAKE_F_REQ_COMPLETED but hp_done() may not have finished, yet svc_sock_free() proceeds to kfree(svsk). The cancel-loser fall-through inside svc_tcp_handshake() itself produces the same window: when wait_for_completion_interruptible_timeout() returns <= 0 (timeout or signal) and tls_handshake_cancel() returns false, the function does not drain, returns, and svc_handle_xprt() calls svc_xprt_received(), which clears XPT_BUSY and can drop the last reference. A concurrent close then runs svc_sock_free() while svc_tcp_handshake_done() is still updating xpt_flags and walking svsk->sk_handshake_done. The corruption surfaces as set_bit/clear_bit RMW into the freed xpt_flags slab slot and as complete_all() walking and writing the freed wait_queue_head_t list embedded in sk_handshake_done -- a slab-corruption primitive, not a benign read. The path is reachable on any TLS-enabled NFS server whenever a connection close overlaps the tlshd downcall delivery window; the interruptible wait means signal delivery suffices, not just SVC_HANDSHAKE_TO expiry. Take svc_xprt_get(xprt) immediately before tls_server_hello_x509() so the in-flight callback owns its own reference. Release it on the two edges where the callback is guaranteed not to fire -- submission failure from tls_server_hello_x509() and a successful tls_handshake_cancel() -- and at the tail of svc_tcp_handshake_done() after complete_all(). [cel: rewrote commit message to describe the actual change]
Title		sunrpc: pin svc_xprt across the asynchronous TLS handshake callback
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/083e9c2ec7e8bb13b79c9fd7b337abdd758ecc5f https://git.kernel.org/stable/c/2d4f97d13fff91e0bc539216be88b884b544d49f https://git.kernel.org/stable/c/3f9ee75a97a769be258784c22b89657acb5ed9bd https://git.kernel.org/stable/c/4f988f3a2808fb659f3880c282041ff067acad78 https://git.kernel.org/stable/c/f3b55945dd99f29d83e1965d0141040a35262346

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:54:15.277Z

Updated: 2026-08-17T05:41:44.196Z

Reserved: 2026-08-09T03:40:39.913Z

Link: CVE-2026-72222

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:21:41.120

Modified: 2026-08-17T06:18:23.293

Link: CVE-2026-72222

Redhat

Severity : Important

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72222 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-22T08:00:13Z

Weaknesses

CWE-416
Use After Free
CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object