CVE-2026-63979

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net/handshake: hand off the pinned file reference to accept_doit<br /> <br /> handshake_req_next() removes the request from the per-net<br /> pending list and drops hn_lock before handshake_nl_accept_doit()<br /> reads req-&gt;hr_sk-&gt;sk_socket and dereferences sock-&gt;file (once in<br /> FD_PREPARE() and again in get_file()). In that window a<br /> consumer running tls_handshake_cancel() followed by sockfd_put()<br /> (svc_sock_free) or __fput_sync() (xs_reset_transport) releases<br /> sock-&gt;file. sock_release() then runs sock_orphan(), zeroing<br /> sk_socket, and frees the struct socket. The accept-side code<br /> either reads NULL through sk_socket or chases freed memory.<br /> <br /> The submit-side sock_hold() does not prevent this. sk_refcnt<br /> protects struct sock, but struct socket and sock-&gt;file are<br /> independently refcounted via the file descriptor the consumer<br /> owns. Pinning sk leaves sock and sock-&gt;file unprotected.<br /> <br /> Retarget the accept-side dereferences at req-&gt;hr_file, which was<br /> pinned at submit time, instead of req-&gt;hr_sk-&gt;sk_socket-&gt;file.<br /> Pinning on its own is not sufficient: a consumer that cancels<br /> between handshake_req_next() returning and accept_doit reaching<br /> FD_PREPARE() takes the !remove_pending() branch in<br /> handshake_req_cancel() and drops hr_file before the accept side<br /> takes its own reference. Hand off an additional file reference<br /> inside handshake_req_next(), under hn_lock, so the accept side<br /> operates on a reference that no concurrent handshake_req_cancel()<br /> can revoke. FD_PREPARE() consumes that handed-off reference,<br /> either by transferring it to the new fd in fd_publish() or by<br /> dropping it in the cleanup destructor on error; the explicit<br /> get_file() that previously balanced FD_PREPARE() is therefore<br /> redundant and goes away.<br /> <br /> Update handshake_req_cancel_test2 and _test3 to simulate the<br /> FD_PREPARE() consumption with an fput() so the kunit file-count<br /> assertions stay balanced.