CVE-2026-64523 net/handshake: Take a long-lived file reference at submit
A use-after-free vulnerability in the Linux kernel's handshake subsystem allows attackers to potentially execute code or escalate privileges.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64523?
CVE-2026-64523 is a critical use after free vulnerability in Linux, published on 25 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net/handshake: Take a long-lived file reference at submit
handshake_nl_accept_doit() needs the file pointer backing req->hr_sk->sk_socket to survive the window between handshake_req_next() and the subsequent FD_PREPARE() and get_file(). The submit-side sock_hold() does not provide that. sk_refcnt keeps struct sock alive, but struct socket is owned by sock->file: when the consumer fputs the last file reference, sock_release() tears the socket down regardless of any sock_hold.
Add an hr_file pointer to struct handshake_req and acquire an explicit reference on sock->file during handshake_req_submit(). handshake_complete() and handshake_req_cancel() release the reference on the completion-bit-winning path.
The submit error path must also release the file reference, but after rhashtable insertion a concurrent handshake_req_cancel() can discover the request and race the error path. Gate the error-path cleanup -- sk_destruct restoration, fput, and request destruction -- with test_and_set_bit(HANDSHAKE_F_REQ_COMPLETED), the same serialization handshake_complete() and handshake_req_cancel() already use. When cancel has already claimed ownership, the submit error path returns without touching the request; socket teardown handles final destruction.
The accept-side dereferences are not yet retargeted; that change comes in the next patch.
Weakness: CWE-416
Which versions are affected by CVE-2026-64523?
How do I fix CVE-2026-64523?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-64523 being exploited?
There is no known exploitation of CVE-2026-64523 in the wild and no public exploit code.
Sources
Also known as AZL-93725, BELL-CVE-2026-64523, DEBIAN-CVE-2026-64523, GHSA-fc48-5g6g-x546, ROOT-OS-UBUNTU-2204-CVE-2026-64523, UBUNTU-CVE-2026-64523.