The Linux kernel’s handshake Genl family provides two downcalls, ACCEPT and DONE. ACCEPT already requires GENL_ADMIN_PERM, but DONE has no privilege check. As a result, an unprivileged process that can guess or observe a valid socket file descriptor can send a forged DONE message with status 0, causing the kernel to treat the handshake as successful, or with a non‑zero status to tear down a legitimate handshake before tlshd reports the real result. This flaw ultimately allows an attacker to bypass the trust boundary established by the handshake mechanism, potentially enabling unauthorized operations or privilege escalation. The vulnerability is categorized as improper authorization check (CWE‑290).

The affected product is the Linux kernel itself, through the handshake Genl interface. The bug is not tied to a specific kernel version in the public data; any kernel that has not incorporated the fixes from the commits referenced in the advisory remains susceptible. The advisory references several commit hashes, indicating the patch was made in the kernel’s normal development branches. Administrators should identify the kernel release running on their systems and verify that it contains the relevant changes; kernel versions prior to the fix are vulnerable.

The CVSS score of 7.8 indicates a high vulnerability, and the EPSS score of <1 % shows a very low probability of exploitation in the wild. The flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker must have local system access and be able to determine a valid handshake socket descriptor; thus the exploitation vector is likely local. Because the DONE command accepts a zero status without verification, the exploit can trick the kernel into accepting an unverified handshake, granting the attacker privileged state or disrupting legitimate handshakes, leading to moderate‑to‑high risk depending on the use case.