CVE-2026-63979 Overview
CVE-2026-63979 is a use-after-free vulnerability in the Linux kernel's net/handshake subsystem. The flaw exists in the interaction between handshake_req_next() and handshake_nl_accept_doit(). After handshake_req_next() removes a request from the per-net pending list and drops hn_lock, a concurrent consumer can call tls_handshake_cancel() followed by sockfd_put() or __fput_sync(), releasing sock->file and freeing the underlying struct socket. The accept path then dereferences freed memory or reads a NULL sk_socket. The upstream fix hands off a pinned file reference to the accept side under hn_lock, eliminating the race.
Critical Impact
A race condition in the kernel handshake netlink path enables use-after-free access on struct socket and sock->file, exposing affected systems to memory corruption reachable over the network.
Affected Products
- Linux kernel (upstream) — net/handshake subsystem
- Distributions shipping the vulnerable net/handshake code prior to the fix commits
- Kernel builds enabling TLS handshake upcall functionality
Discovery Timeline
- 2026-07-19 - CVE-2026-63979 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-63979
Vulnerability Analysis
The defect is a classic use-after-free triggered by a race between the submit and cancel paths of the kernel handshake netlink API. handshake_req_next() pops a request from the per-net pending list and releases hn_lock before handshake_nl_accept_doit() dereferences req->hr_sk->sk_socket and sock->file. Both FD_PREPARE() and the subsequent get_file() operate on that pointer.
During that window, a consumer running tls_handshake_cancel() followed by sockfd_put() (via svc_sock_free) or __fput_sync() (via xs_reset_transport) can drop the last reference to sock->file. sock_release() then invokes sock_orphan(), zeroing sk_socket and freeing the struct socket. The accept path either reads NULL or dereferences freed memory. The vulnerability is reachable through the network handshake control plane.
Root Cause
The submit-side sock_hold() only protects struct sock via sk_refcnt. struct socket and sock->file are refcounted independently through the file descriptor owned by the consumer. Pinning sk alone leaves the socket container and its file pointer exposed to concurrent release, producing a use-after-free when the accept side dereferences them.
Attack Vector
A local or network-adjacent actor able to interact with the kernel TLS handshake upcall mechanism can drive the cancel path concurrently with an in-flight accept operation. Precise timing between handshake_req_next() returning and FD_PREPARE() executing determines whether the freed struct socket is read. The fix retargets accept-side dereferences at req->hr_file, which is pinned at submit time, and hands off an additional file reference inside handshake_req_next() under hn_lock. FD_PREPARE() consumes the handed-off reference, so no concurrent handshake_req_cancel() can revoke it.
No public proof-of-concept is available. Technical details are documented in the kernel commit references c06876d4fac3 and f4251190e58b.
Detection Methods for CVE-2026-63979
Indicators of Compromise
- Kernel oops or general protection fault entries referencing handshake_nl_accept_doit, handshake_req_next, or sock_release in dmesg and /var/log/kern.log.
- KASAN reports flagging use-after-free reads on struct socket or NULL dereferences of sk_socket in the net/handshake path.
- Unexpected termination of user-space TLS handshake helpers (tlshd) coinciding with kernel warnings.
Detection Strategies
- Enable CONFIG_KASAN on test kernels to surface the exact use-after-free during handshake cancel/accept races.
- Monitor kernel crash telemetry for stack traces containing handshake_req_next, FD_PREPARE, tls_handshake_cancel, svc_sock_free, or xs_reset_transport.
- Correlate tlshd process exits with concurrent NFS or kernel TLS session teardown events.
Monitoring Recommendations
- Ship kernel logs to a centralized platform and alert on oops signatures matching the net/handshake call chain.
- Track kernel package versions across the fleet and flag hosts running builds without the upstream fix commits.
- Baseline handshake upcall failure rates so anomalous spikes tied to socket teardown become visible.
How to Mitigate CVE-2026-63979
Immediate Actions Required
- Apply distribution kernel updates that include commits c06876d4fac3 and f4251190e58b from the stable tree.
- Reboot updated hosts to activate the patched kernel; live-patching is not available for this change on most distributions.
- Inventory systems running tlshd and kernel TLS consumers such as NFS-over-TLS and prioritize their patching.
Patch Information
The upstream resolution retargets accept-side dereferences at req->hr_file and hands off an additional file reference inside handshake_req_next() under hn_lock. The redundant get_file() previously balancing FD_PREPARE() is removed, and handshake_req_cancel_test2 and _test3 kunit tests are updated with an fput() to keep file-count assertions balanced. See kernel commits c06876d4fac3 and f4251190e58b.
Workarounds
- Disable or unload the kernel TLS handshake upcall path where it is not required, including stopping the tlshd user-space service.
- Avoid enabling NFS-over-TLS and other consumers of net/handshake on unpatched kernels.
- Restrict local access to systems that must expose the handshake netlink interface until the patched kernel is deployed.
# Verify running kernel version and confirm patched build is active
uname -r
# Stop the TLS handshake user-space helper on unpatched hosts
systemctl stop tlshd
systemctl disable tlshd
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
