CVE-2026-64115

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmcitransportrecvconnectingserver returned err = 0 for a peer RST in its default switch arm: err = pkt-type == VMCITRANSPORTPACKETTYPERST ? 0 : -EINVAL; That made...

CVE-2026-63980

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Use spinlockbh for hnlock nvmettcpstatechange, a socket callback that runs in BH context, can reach handshakereqcancel via nvmettcpschedulereleasequeue and tlshandshakecancel. handshakereqcancel acquires hn-hnlock...

CVE-2026-63979

In the Linux kernel, the following vulnerability has been resolved: net/handshake: hand off the pinned file reference to acceptdoit handshakereqnext removes the request from the per-net pending list and drops hnlock before handshakenlacceptdoit reads req-hrsk-sksocket and dereferences sock-file...

CVE-2026-63978

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Drain pending requests at net namespace exit The arguments to listspliceinit in handshakenetexit are reversed. The call moves the local empty "requests" list onto hn-hnrequests, leaving the local list empty, so the...

CVE-2026-64115

The CVE-2026-64115 entry describes a Linux kernel fix for a UAF in vsock/vmci when a peer resets during the handshake. The vulnerability occurred because vmci_transport_recv_connecting_server() incorrectly returned 0 for an RST, causing vmci_transport_recv_listen() to skip vsock_remove_pending() ...

CVE-2026-64115 vsock/vmci: fix UAF when peer resets connection during handshake

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmcitransportrecvconnectingserver returned err = 0 for a peer RST in its default switch arm: err = pkt-type == VMCITRANSPORTPACKETTYPERST ? 0 : -EINVAL; That made...

CVE-2026-64115

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmcitransportrecvconnectingserver returned err = 0 for a peer RST in its default switch arm: err = pkt-type == VMCITRANSPORTPACKETTYPERST ? 0 : -EINVAL; That made...

EUVD-2026-45800

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmcitransportrecvconnectingserver returned err = 0 for a peer RST in its default switch arm: err = pkt-type == VMCITRANSPORTPACKETTYPERST ? 0 : -EINVAL; That made...

CVE-2026-63980

CVE-2026-63980 (Linux kernel) : A bug in nvmet_tcp_path handling can deadlock due to a BH-context handshake cancel path. Specifically, nvmet_tcp_state_change() can reach handshake_req_cancel() via nvmet_tcp_schedule_release_queue() and tls_handshake_cancel(), where hn->hn_lock was acquired wit...

CVE-2026-63979

The CVE-2026-63979 issue affects the Linux kernel net/handshake path. It describes a race where accept-side code dereferenced sock->file via req->hr_sk->sk_socket during FD_PREPARE(), while a concurrent cancellation could drop sock->file, leading to NULL reads on the accept side. The ...

CVE-2026-63979 net/handshake: hand off the pinned file reference to accept_doit

In the Linux kernel, the following vulnerability has been resolved: net/handshake: hand off the pinned file reference to acceptdoit handshakereqnext removes the request from the per-net pending list and drops hnlock before handshakenlacceptdoit reads req-hrsk-sksocket and dereferences sock-file...

CVE-2026-63980 net/handshake: Use spin_lock_bh for hn_lock

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Use spinlockbh for hnlock nvmettcpstatechange, a socket callback that runs in BH context, can reach handshakereqcancel via nvmettcpschedulereleasequeue and tlshandshakecancel. handshakereqcancel acquires hn-hnlock...

EUVD-2026-45752

In the Linux kernel, the following vulnerability has been resolved: net/handshake: hand off the pinned file reference to acceptdoit handshakereqnext removes the request from the per-net pending list and drops hnlock before handshakenlacceptdoit reads req-hrsk-sksocket and dereferences sock-file...

EUVD-2026-45753

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Use spinlockbh for hnlock nvmettcpstatechange, a socket callback that runs in BH context, can reach handshakereqcancel via nvmettcpschedulereleasequeue and tlshandshakecancel. handshakereqcancel acquires hn-hnlock...

CVE-2026-63978

The CVE concerns the Linux kernel net/handshake subsystem where, in handshake_net_exit(), the arguments to list_splice_init() were reversed, causing pending handshake requests not to be drained when a net namespace is destroyed. This left references on sockets and handshake_req allocations, enabl...

CVE-2026-63978 net/handshake: Drain pending requests at net namespace exit

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Drain pending requests at net namespace exit The arguments to listspliceinit in handshakenetexit are reversed. The call moves the local empty "requests" list onto hn-hnrequests, leaving the local list empty, so the...

EUVD-2026-45751

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Drain pending requests at net namespace exit The arguments to listspliceinit in handshakenetexit are reversed. The call moves the local empty "requests" list onto hn-hnrequests, leaving the local list empty, so the...

PT-2026-61295

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Drain pending requests at net namespace exit The arguments to list splice init in handshake net exit are reversed. The call moves the local empty "requests" list onto hn-hn requests, leaving the local list empty, s...

PT-2026-61432

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmci transport recv connecting server returned err = 0 for a peer RST in its default switch arm: err = pkt-type == VMCI TRANSPORT PACKET TYPE RST ? 0 : -EINVAL; Tha...

PT-2026-61296

In the Linux kernel, the following vulnerability has been resolved: net/handshake: hand off the pinned file reference to accept doit handshake req next removes the request from the per-net pending list and drops hn lock before handshake nl accept doit reads req-hr sk-sk socket and dereferences...