CVE-2026-63979

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the net/handshake component. The handshake req next() function removes a request from the pending list and releases the hn lock before handshake nl accept doit() accesses req->hr sk->sk socket and dereferences sock->file. During this window, a concurrent process executing tls handshake cancel() followed by sockfd put() or fput sync() can release sock->file. Subsequently, sock release() triggers sock orphan(), which zeroes sk socket and frees the socket structure. This leads to the accept-side code either reading a NULL value or accessing freed memory. The issue occurs because sk refcnt only protects the struct sock, while struct socket and sock->file are managed by independent reference counts via the consumer's file descriptor.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.