CVE-2026-64523

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the net/handshake component where the handshake nl accept doit() function requires the file pointer backing req->hr sk->sk socket to remain valid between the execution of handshake req next() and the subsequent FD PREPARE() and get file() calls. The existing sock hold() on the submit side is insufficient because while sk refcnt keeps the struct sock alive, the struct socket is owned by sock->file. If the consumer performs the last fput on the file reference, sock release() triggers socket teardown regardless of any sock hold calls. This creates a race condition during the submit error path after rhashtable insertion, where a concurrent handshake req cancel() can conflict with the error-path cleanup involving sk destruct restoration, fput, and request destruction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.