Executive brief
A vulnerability was identified in the Linux kernel's network handshake mechanism where network sockets could be prematurely closed while a handshake was still in progress. This issue occurs because the system failed to maintain a proper reference to the underlying file associated with the socket, potentially leading to system instability or crashes. This affects the reliability of secure network connections managed by the kernel.
Technical details
A race condition existed in net/handshake/request.c where handshake_nl_accept_doit() required the file pointer backing a socket to remain valid between handshake_req_next() and FD_PREPARE(). Previously, the code relied on sock_hold(), which only keeps the 'struct sock' alive but does not prevent 'struct socket' (owned by the file) from being torn down via sock_release() when a consumer closes the file descriptor. The fix introduces an explicit reference on sock->file during handshake_req_submit() and ensures proper cleanup in error paths using the HANDSHAKE_F_REQ_COMPLETED bit to serialize against concurrent cancellations. An attacker could potentially exploit this race to cause a kernel crash or unpredictable behavior.
Affected products
- Linux Linux 6.12.93, 7.0.12, 7.1
Timeline
- 2026-07-25: disclosed
- 2026-07-25: advisory