CVE-2026-64523 Overview
CVE-2026-64523 is a use-after-free vulnerability in the Linux kernel's net/handshake subsystem. The flaw resides in handshake_nl_accept_doit(), where the file pointer backing req->hr_sk->sk_socket can be released before the code path completes. The submit-side sock_hold() keeps struct sock alive through sk_refcnt, but does not protect struct socket, which is owned by sock->file. When the consumer performs the final fput(), sock_release() tears the socket down regardless of any sock_hold(). The upstream fix introduces an hr_file pointer in struct handshake_req and acquires an explicit reference on sock->file during handshake_req_submit().
Critical Impact
A network-adjacent attacker can trigger a race between handshake submission and cancellation, leading to a use-after-free on kernel socket structures with potential for arbitrary code execution.
Affected Products
- Linux kernel versions containing the net/handshake subsystem prior to the referenced stable patches
- Distributions shipping affected upstream kernel builds
- Systems using the kernel TLS handshake upcall mechanism (for example, kTLS with user-space handshake agents)
Discovery Timeline
- 2026-07-25 - CVE-2026-64523 published to the National Vulnerability Database
- 2026-07-27 - Last updated in NVD database
Technical Details for CVE-2026-64523
Vulnerability Analysis
The vulnerability is a use-after-free condition [CWE-416] in the Linux kernel handshake netlink handler. The handshake_nl_accept_doit() function requires the file pointer backing req->hr_sk->sk_socket to remain valid across the window between handshake_req_next() and the subsequent FD_PREPARE() and get_file() calls. The submit path only calls sock_hold(), which increments sk_refcnt on the underlying struct sock. It does not increment the reference count on the owning struct file.
When a user-space consumer releases the last reference to the file via fput(), sock_release() tears down struct socket immediately. Any later dereference of req->hr_sk->sk_socket operates on freed memory. The kernel network stack then handles attacker-influenced data on a stale socket structure.
Root Cause
The root cause is an object lifetime mismatch between struct sock and struct socket. The submit path assumed sock_hold() was sufficient to keep the socket object usable, but ownership of struct socket flows through sock->file. Without an explicit get_file() on the backing file at submit time, concurrent teardown from the consumer side can free the socket while the handshake request remains queued.
Attack Vector
Exploitation requires a local process that can submit a handshake request through the netlink interface and control the timing of the corresponding file descriptor closure. A concurrent handshake_req_cancel() can race the submit error path after rhashtable insertion, creating a second window where cleanup can occur on an already-claimed request. The completion serialization bit HANDSHAKE_F_REQ_COMPLETED was not previously applied to the submit error path, allowing double-cleanup and use-after-free conditions on the freed socket memory.
The upstream fix, published in commits 09dba37eee70, 16eaba5aa89c, and 685b10dd0e32, adds hr_file to struct handshake_req, calls get_file() at submit time, and gates the error path with test_and_set_bit(HANDSHAKE_F_REQ_COMPLETED).
Detection Methods for CVE-2026-64523
Indicators of Compromise
- Kernel oops or panic messages referencing sock_release, handshake_req_next, or handshake_nl_accept_doit in dmesg or /var/log/kern.log
- KASAN reports flagging use-after-free reads or writes in the net/handshake module
- Unexpected process terminations for user-space TLS handshake agents (for example, tlshd)
Detection Strategies
- Enable Kernel Address Sanitizer (KASAN) in test and staging environments to surface use-after-free access on struct socket allocations
- Audit hosts using the kernel handshake upcall by checking for loaded handshake.ko and active netlink family NETLINK_GENERIC registrations named handshake
- Correlate kernel crash telemetry with processes invoking AF_HANDSHAKE genetlink commands within a short time window
Monitoring Recommendations
- Ship kernel logs and crash dumps to a centralized analytics platform for anomaly detection on net/handshake stack traces
- Track running kernel versions across the fleet and flag hosts running unpatched builds with the handshake subsystem enabled
- Monitor for local processes that repeatedly open and close handshake netlink sockets, which may indicate race-condition probing
How to Mitigate CVE-2026-64523
Immediate Actions Required
- Apply the upstream stable kernel patches 09dba37eee70, 16eaba5aa89c, and 685b10dd0e32 or upgrade to a distribution kernel that includes them
- Inventory hosts with the handshake kernel module loaded and prioritize patching servers running kTLS with user-space handshake daemons
- Restrict local access on affected hosts until a patched kernel is deployed, since exploitation requires local netlink access
Patch Information
The fix is available in the mainline Linux kernel and backported to stable branches through the three referenced commits. The patches add an explicit hr_file reference in struct handshake_req, acquire the file reference during handshake_req_submit(), and release it on the completion-bit-winning path in handshake_complete() and handshake_req_cancel(). Vendor kernel packages from major distributions should pick up the fix in their next security update cycle.
Workarounds
- Unload or blacklist the handshake kernel module on systems that do not require kernel TLS handshake upcalls
- Disable user-space handshake daemons such as tlshd where kTLS is not in production use
- Apply mandatory access control policies (SELinux, AppArmor) to limit which processes can issue handshake genetlink commands
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
