Executive brief
A vulnerability exists in the Linux kernel's network handshake mechanism, which manages secure connection setups. When a connection attempt times out or is cancelled simultaneously by both the client and the server, the system may fail to properly track the connection's status. This can lead to a system crash or instability, potentially allowing an attacker to disrupt network services or compromise the system.
Technical details
A vulnerability in the Linux kernel's net/handshake component arises from improper handling of duplicate handshake cancellation requests. When a handshake is cancelled, it is removed from the pending list but remains in the rhashtbl until destruction. If a second cancellation occurs (e.g., due to simultaneous timeouts in SUNRPC/AUTH_TLS), the `remove_pending()` function returns false, leading the code to incorrectly decrement the socket's reference count again. This results in a refcount underflow and potential socket leak. The fix introduces `test_and_set_bit(HANDSHAKE_F_REQ_COMPLETED)` in the cancellation path to ensure only the first cancellation is processed. Patches are available in stable kernel releases 6.6.120, 6.12.64, and 6.18.3.
Affected products
- Linux Linux 6.4 to 6.6.120, 6.12.64, 6.18.3
Timeline
- 2025-12-09: disclosed: Initial patch submission by Scott Mayhew
- 2026-01-11: patched: Patch committed to stable tree by Greg Kroah-Hartman
- 2026-01-13: advisory: CVE-2025-68775 published