CVE-2026-64115

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmcitransportrecvconnectingserver returned err = 0 for a peer RST in its default switch arm: err = pkt-type == VMCITRANSPORTPACKETTYPERST ? 0 : -EINVAL; That made...

CVE-2026-64115

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmcitransportrecvconnectingserver returned err = 0 for a peer RST in its default switch arm: err = pkt-type == VMCITRANSPORTPACKETTYPERST ? 0 : -EINVAL; That made...

CVE-2026-64115 vsock/vmci: fix UAF when peer resets connection during handshake

In the Linux kernel, the following vulnerability has been resolved: vsock/vmci: fix UAF when peer resets connection during handshake vmcitransportrecvconnectingserver returned err = 0 for a peer RST in its default switch arm: err = pkt-type == VMCITRANSPORTPACKETTYPERST ? 0 : -EINVAL; That made...

CVE-2026-63979 net/handshake: hand off the pinned file reference to accept_doit

In the Linux kernel, the following vulnerability has been resolved: net/handshake: hand off the pinned file reference to acceptdoit handshakereqnext removes the request from the per-net pending list and drops hnlock before handshakenlacceptdoit reads req-hrsk-sksocket and dereferences sock-file...

CVE-2026-63979

CVE-2026-63979: In the Linux kernel, a use-after-free-like window can occur during TLS handshakes in net/handshake where accept-side dereferences use sock->file via req->hr_sk->sk_socket. The fix retargets dereferences to req->hr_file (pinned at submit time) and adds an extra file ref...

CVE-2026-63979

In the Linux kernel, the following vulnerability has been resolved: net/handshake: hand off the pinned file reference to acceptdoit handshakereqnext removes the request from the per-net pending list and drops hnlock before handshakenlacceptdoit reads req-hrsk-sksocket and dereferences sock-file...

CVE-2026-63979 net/handshake: hand off the pinned file reference to accept_doit

In the Linux kernel, the following vulnerability has been resolved: net/handshake: hand off the pinned file reference to acceptdoit handshakereqnext removes the request from the per-net pending list and drops hnlock before handshakenlacceptdoit reads req-hrsk-sksocket and dereferences sock-file...

CVE-2026-63980

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Use spinlockbh for hnlock nvmettcpstatechange, a socket callback that runs in BH context, can reach handshakereqcancel via nvmettcpschedulereleasequeue and tlshandshakecancel. handshakereqcancel acquires hn-hnlock...

CVE-2026-63980 net/handshake: Use spin_lock_bh for hn_lock

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Use spinlockbh for hnlock nvmettcpstatechange, a socket callback that runs in BH context, can reach handshakereqcancel via nvmettcpschedulereleasequeue and tlshandshakecancel. handshakereqcancel acquires hn-hnlock...

EUVD-2026-45753

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Use spinlockbh for hnlock nvmettcpstatechange, a socket callback that runs in BH context, can reach handshakereqcancel via nvmettcpschedulereleasequeue and tlshandshakecancel. handshakereqcancel acquires hn-hnlock...

CVE-2026-63980

CVE-2026-63980 affects the Linux kernel net/handshake path in NVMe targets. nvmet_tcp_state_change() can reach handshake_req_cancel() via nvmet_tcp_schedule_release_queue() and tls_handshake_cancel(), where hn_lock was acquired with spin_lock(). If a process-context thread holds the lock while a ...

EUVD-2026-45752

In the Linux kernel, the following vulnerability has been resolved: net/handshake: hand off the pinned file reference to acceptdoit handshakereqnext removes the request from the per-net pending list and drops hnlock before handshakenlacceptdoit reads req-hrsk-sksocket and dereferences sock-file...

CVE-2026-63980 net/handshake: Use spin_lock_bh for hn_lock

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Use spinlockbh for hnlock nvmettcpstatechange, a socket callback that runs in BH context, can reach handshakereqcancel via nvmettcpschedulereleasequeue and tlshandshakecancel. handshakereqcancel acquires hn-hnlock...

CVE-2026-63978

The CVE-2026-63978 issue affects the Linux kernel in net/handshake handling during net namespace exit. The root cause is reversed arguments to list_splice_init() in handshake_net_exit(), which transfers the pending handshake requests to the wrong list, causing the drain loop to skip, leaving some...

CVE-2026-63978 net/handshake: Drain pending requests at net namespace exit

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Drain pending requests at net namespace exit The arguments to listspliceinit in handshakenetexit are reversed. The call moves the local empty "requests" list onto hn-hnrequests, leaving the local list empty, so the...

EUVD-2026-45751

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Drain pending requests at net namespace exit The arguments to listspliceinit in handshakenetexit are reversed. The call moves the local empty "requests" list onto hn-hnrequests, leaving the local list empty, so the...

CVE-2026-63978 net/handshake: Drain pending requests at net namespace exit

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Drain pending requests at net namespace exit The arguments to listspliceinit in handshakenetexit are reversed. The call moves the local empty "requests" list onto hn-hnrequests, leaving the local list empty, so the...

CVE-2026-63978

In the Linux kernel, the following vulnerability has been resolved: net/handshake: Drain pending requests at net namespace exit The arguments to listspliceinit in handshakenetexit are reversed. The call moves the local empty "requests" list onto hn-hnrequests, leaving the local list empty, so the...

PT-2026-61295

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the net/handshake component where pending requests are not properly drained during net namespace exit. This occurs because the arguments to the list splice init functi...

PT-2026-61432

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A use-after-free issue exists in the vsock/vmci component. The vmci transport recv connecting server function incorrectly returns a success value when a peer sends a reset RST packet...