CVE-2026-72221

In the Linux kernel, the following vulnerability has been resolved: sunrpc: wait for in-flight TLS handshake callback when cancel loses race When waitforcompletioninterruptibletimeout in svctcphandshake returns 0 timeout or -ERESTARTSYS signal and tlshandshakecancel then returns false,...

EUVD-2026-59532

In the Linux kernel, the following vulnerability has been resolved: nvmet-tcp: check return value of nvmettcpsetqueuesock The return value of nvmettcpsetqueuesock is currently ignored in nvmettcptlshandshakedone. If it fails e.g., due to the socket not being in TCPESTABLISHED state, the socket...

EUVD-2026-59417

In the Linux kernel, the following vulnerability has been resolved: handshake: Require admin permission for DONE command ACCEPT and DONE are the two downcalls of the handshake genl family, both intended for use by the trusted handshake agent tlshd. ACCEPT already requires GENLADMINPERM; DONE has ...

CVE-2026-72330 net/tls: Consume empty data records in tls_sw_read_sock()

In the Linux kernel, the following vulnerability has been resolved: net/tls: Consume empty data records in tlsswreadsock A peer may send a zero-length TLS applicationdata record; TLS 1.3 explicitly permits these as a traffic-analysis countermeasure RFC 8446, Section 5.1. After decryption such a...

CVE-2026-72330 net/tls: Consume empty data records in tls_sw_read_sock()

In the Linux kernel, the following vulnerability has been resolved: net/tls: Consume empty data records in tlsswreadsock A peer may send a zero-length TLS applicationdata record; TLS 1.3 explicitly permits these as a traffic-analysis countermeasure RFC 8446, Section 5.1. After decryption such a...

EUVD-2026-59229

In the Linux kernel, the following vulnerability has been resolved: net/tls: Consume empty data records in tlsswreadsock A peer may send a zero-length TLS applicationdata record; TLS 1.3 explicitly permits these as a traffic-analysis countermeasure RFC 8446, Section 5.1. After decryption such a...

CVE-2026-72330

The CVE-2026-72330 entry documents a Linux kernel vulnerability in the TLS data path. A peer can send a zero-length TLS application_data record (TLS 1.3 allows these as a traffic-analysis countermeasure). After decryption such a record has full_len == 0 and, in tls_sw_read_sock(), the read loop r...

EUVD-2026-59216

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: pin upper rpcclnt across the TLS connectworker The TLS connect path has a use-after-free: nothing pins the upper rpcclnt across the delayed connectworker. xsconnect stores task-tkclient in sockxprt::clnt as a raw pointer...

CVE-2026-72317 SUNRPC: pin upper rpc_clnt across the TLS connect_worker

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: pin upper rpcclnt across the TLS connectworker The TLS connect path has a use-after-free: nothing pins the upper rpcclnt across the delayed connectworker. xsconnect stores task-tkclient in sockxprt::clnt as a raw pointer...

CVE-2026-72317 SUNRPC: pin upper rpc_clnt across the TLS connect_worker

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: pin upper rpcclnt across the TLS connectworker The TLS connect path has a use-after-free: nothing pins the upper rpcclnt across the delayed connectworker. xsconnect stores task-tkclient in sockxprt::clnt as a raw pointer...

CVE-2026-72317

In the Linux kernel SUNRPC TLS connect path, a use-after-free occurs because upper rpc_clnt is not pinned across the delayed TLS connect_worker. The TLS handshake worker xs_tcp_tls_setup_socket() reads saved fields from a freed rpc_clnt when a handshake fails, leading to a refcount underflow. The...

EUVD-2026-59121

In the Linux kernel, the following vulnerability has been resolved: sunrpc: pin svcxprt across the asynchronous TLS handshake callback svctcphandshake stores the raw svcxprt pointer in tlshandshakeargs.tadata and submits the request through tlsserverhellox509. The handshake core takes only...

CVE-2026-72222

The CVE-2026-72222 entry corresponds to a Linux kernel vulnerability in the sunrpc TLS handshake path. The issue arises from races where an in-flight async TLS handshake callback can write through a freed svc_sock, due to the embedding svc_sock being container_of() referenced after tls_handshake_...

CVE-2026-72222 sunrpc: pin svc_xprt across the asynchronous TLS handshake callback

In the Linux kernel, the following vulnerability has been resolved: sunrpc: pin svcxprt across the asynchronous TLS handshake callback svctcphandshake stores the raw svcxprt pointer in tlshandshakeargs.tadata and submits the request through tlsserverhellox509. The handshake core takes only...

CVE-2026-72222 sunrpc: pin svc_xprt across the asynchronous TLS handshake callback

In the Linux kernel, the following vulnerability has been resolved: sunrpc: pin svcxprt across the asynchronous TLS handshake callback svctcphandshake stores the raw svcxprt pointer in tlshandshakeargs.tadata and submits the request through tlsserverhellox509. The handshake core takes only...

EUVD-2026-59120

In the Linux kernel, the following vulnerability has been resolved: sunrpc: wait for in-flight TLS handshake callback when cancel loses race When waitforcompletioninterruptibletimeout in svctcphandshake returns 0 timeout or -ERESTARTSYS signal and tlshandshakecancel then returns false,...

CVE-2026-72221

The CVE describes a race in the Linux kernel sunrpc TLS handshake path. When wait_for_completion_interruptible_timeout() times out or is interrupted, handshake_complete() may race with tls_handshake_cancel(): if the handshake callback has set HANDSHAKE_F_REQ_COMPLETED or XPT_TLS_SESSION but not y...

CVE-2026-72221 sunrpc: wait for in-flight TLS handshake callback when cancel loses race

In the Linux kernel, the following vulnerability has been resolved: sunrpc: wait for in-flight TLS handshake callback when cancel loses race When waitforcompletioninterruptibletimeout in svctcphandshake returns 0 timeout or -ERESTARTSYS signal and tlshandshakecancel then returns false,...

CVE-2026-72221 sunrpc: wait for in-flight TLS handshake callback when cancel loses race

In the Linux kernel, the following vulnerability has been resolved: sunrpc: wait for in-flight TLS handshake callback when cancel loses race When waitforcompletioninterruptibletimeout in svctcphandshake returns 0 timeout or -ERESTARTSYS signal and tlshandshakecancel then returns false,...

PT-2026-72518

In the Linux kernel, the following vulnerability has been resolved: net/tls: Consume empty data records in tls sw read sock A peer may send a zero-length TLS application data record; TLS 1.3 explicitly permits these as a traffic-analysis countermeasure RFC 8446, Section 5.1. After decryption such...