CVE-2026-72317 SUNRPC: pin upper rpc_clnt across the TLS connect_worker

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: pin upper rpcclnt across the TLS connectworker The TLS connect path has a use-after-free: nothing pins the upper rpcclnt across the delayed connectworker. xsconnect stores task-tkclient in sockxprt::clnt as a raw pointer...

CVE-2026-72317 SUNRPC: pin upper rpc_clnt across the TLS connect_worker

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: pin upper rpcclnt across the TLS connectworker The TLS connect path has a use-after-free: nothing pins the upper rpcclnt across the delayed connectworker. xsconnect stores task-tkclient in sockxprt::clnt as a raw pointer...

CVE-2026-72222 sunrpc: pin svc_xprt across the asynchronous TLS handshake callback

In the Linux kernel, the following vulnerability has been resolved: sunrpc: pin svcxprt across the asynchronous TLS handshake callback svctcphandshake stores the raw svcxprt pointer in tlshandshakeargs.tadata and submits the request through tlsserverhellox509. The handshake core takes only...

EUVD-2026-59121

In the Linux kernel, the following vulnerability has been resolved: sunrpc: pin svcxprt across the asynchronous TLS handshake callback svctcphandshake stores the raw svcxprt pointer in tlshandshakeargs.tadata and submits the request through tlsserverhellox509. The handshake core takes only...

CVE-2026-72222

The CVE-2026-72222 entry corresponds to a Linux kernel vulnerability in the sunrpc TLS handshake path. The issue arises from races where an in-flight async TLS handshake callback can write through a freed svc_sock, due to the embedding svc_sock being container_of() referenced after tls_handshake_...

CVE-2026-72222 sunrpc: pin svc_xprt across the asynchronous TLS handshake callback

In the Linux kernel, the following vulnerability has been resolved: sunrpc: pin svcxprt across the asynchronous TLS handshake callback svctcphandshake stores the raw svcxprt pointer in tlshandshakeargs.tadata and submits the request through tlsserverhellox509. The handshake core takes only...

EUVD-2026-59120

In the Linux kernel, the following vulnerability has been resolved: sunrpc: wait for in-flight TLS handshake callback when cancel loses race When waitforcompletioninterruptibletimeout in svctcphandshake returns 0 timeout or -ERESTARTSYS signal and tlshandshakecancel then returns false,...

CVE-2026-72221 sunrpc: wait for in-flight TLS handshake callback when cancel loses race

In the Linux kernel, the following vulnerability has been resolved: sunrpc: wait for in-flight TLS handshake callback when cancel loses race When waitforcompletioninterruptibletimeout in svctcphandshake returns 0 timeout or -ERESTARTSYS signal and tlshandshakecancel then returns false,...

CVE-2026-72221

The CVE describes a race in the Linux kernel sunrpc TLS handshake path. When wait_for_completion_interruptible_timeout() times out or is interrupted, handshake_complete() may race with tls_handshake_cancel(): if the handshake callback has set HANDSHAKE_F_REQ_COMPLETED or XPT_TLS_SESSION but not y...

CVE-2026-72221 sunrpc: wait for in-flight TLS handshake callback when cancel loses race

In the Linux kernel, the following vulnerability has been resolved: sunrpc: wait for in-flight TLS handshake callback when cancel loses race When waitforcompletioninterruptibletimeout in svctcphandshake returns 0 timeout or -ERESTARTSYS signal and tlshandshakecancel then returns false,...

PT-2026-72821

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check return value of nvmet tcp set queue sock The return value of nvmet tcp set queue sock is currently ignored in nvmet tcp tls handshake done. If it fails e.g., due to the socket not being in TCP ESTABLISHED state,...

PT-2026-72410

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the sunrpc component of the Linux kernel affecting TLS-enabled NFS servers. A race condition occurs during the asynchronous TLS handshake when a connection is closed,...

PT-2026-72409

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A race condition exists in the sunrpc component during TLS handshake cancellation. When the wait for completion interruptible timeout function in svc tcp handshake returns a timeout or...

AZL-98616 CVE-2026-56862 affecting package golang 1.27.1-1

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely...

CVE-2026-56862

Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely...

eclipse-vertx/vert.x: eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name

A flaw was found in eclipse-vertx/vert.x. A remote attacker can exploit this vulnerability by performing a Transport Layer Security TLS handshake and presenting a server name extension with a server wildcard name. This can lead to a denial of service DoS condition, impacting the availability of t...

PT-2026-71899

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description Handshake messages, such as KeyUpdate, are treated as state-advancing regardless of whether a handshake has been completed. This allows a malicious client to...

CVE-2026-73500

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listenertls.go, each connection handle...

DEBIAN-CVE-2026-73500

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listenertls.go, each connection handle...

AZL-95946 CVE-2026-73500 affecting package prometheus-adapter for versions less than 0.12.0-9

etcd is a distributed key-value store for the data of a distributed system. Prior to versions 3.5.33, 3.6.14, and 3.7.1, a network attacker who can reach an etcd TLS listener can open many TCP connections and never send a ClientHello. In client/pkg/transport/listenertls.go, each connection handle...