Skip to main content

Linux Kernel CVE-2025-68775

CRITICAL
Improper Synchronization (CWE-662)
2026-01-13 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Information Disclosure Linux
Critical
Disputed · 9.8 Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Establish SUNRPC-over-TLS handshake to server
  2. Delivery
    Stall after AUTH_TLS probe, withhold ClientHello
  3. Exploit
    Handshake times out, FIN sent
  4. Install
    Duplicate cancel hits same request
  5. C2
    remove_pending() fails, extra sock_put()
  6. Execute
    Socket refcount underflow / UAF
  7. Impact
    Kernel crash or memory corruption

Vulnerability Assessment

Weakness
CWE
CWE-662
Exploitation Conditions

Exploitation requires the target kernel to be actively using the in-kernel TLS handshake upcall path - in practice SUNRPC/NFS mounted with TLS (xprtsec=tls/mtls) and the userspace tlshd handshake daemon running. The concrete trigger is a handshake that times out such that two cancellation requests are issued for the same request (server-side FIN-driven xs_reset_transport() plus client-side xs_tls_handshake_sync()), so the request is already removed from hn_requests but still resident in handshake_rhashtbl. Limiting factors: the flaw is not reachable on systems that do not use kernel TLS handshakes (default configurations without NFS/RPC-over-TLS are unaffected), it depends on a timing/race condition rather than a deterministic request, and its outcome is memory corruption (crash/UAF) rather than guaranteed data theft - so the AV:N/AC:L/PR:N/UI:N vector overstates ease of exploitation. Authentication requirements are not cleanly confirmable because the trigger is a protocol timeout condition rather than an authenticated action; the supplied vector states PR:N.
Impact

Signals conflict sharply and should temper the 9.8 rating. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N, C:H/I:H/A:H) implies trivially exploitable unauthenticated network RCE, but the description makes clear the bug is a race-driven refcount underflow reachable only when the kernel TLS handshake upcall path is in use and a handshake times out under specific SUNRPC/tlshd conditions - i.e. it is materially harder (a timing/race precondition) and its most reliable outcome is a kernel oops/DoS or use-after-free, not straightforward information disclosure or code execution. EPSS is 0.03% (7th percentile) and the CVE is NOT in CISA KEV, consistent with no observed exploitation. There is no SSVC record, no POC, and no KEV in the input. Net assessment: this is a real memory-safety bug worth patching on hosts that run NFS/SUNRPC-over-TLS, but it is a low-urgency, targeted-conditions issue rather than a mass-exploitation priority - the high CVSS overstates real-world risk. The AC:L in the supplied vector is questionable given the described double-cancel race; treat AC as High.
Exploit ScenarioDerived

An attacker (or simply an unreliable network/tlshd) causes a kernel TLS handshake for a SUNRPC-over-TLS connection to stall after the AUTH_TLS probe: the client never sends ClientHello, so the server times out, sends a FIN, and a cancellation fires via xs_reset_transport() while the client independently cancels via xs_tls_handshake_sync(). The two cancels hit the same handshake request, driving a socket refcount underflow that can crash the kernel or set up a use-after-free. No public exploit code is identified at time of analysis, and weaponizing the UAF for code execution would require additional heap-grooming primitives.
Act Now Prioritize within 24-48h. Why: CRITICAL severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv2 – Jul 30, 2026

Refcount underflow in the Linux kernel's net/handshake subsystem lets duplicate cancellation of the same TLS handshake request drop an extra reference on the underlying socket, corrupting its reference count and leaking/freeing the socket structure. The flaw affects kernels using the in-kernel TLS handshake upcall path (notably SUNRPC-over-TLS via tlshd), where a handshake timeout can trigger two cancellation requests - one from xs_reset_transport() and one from xs_tls_handshake_sync() - for a request still present in handshake_rhashtbl. Despite an assigned 9.8 CVSS, the practical impact is a kernel memory-safety fault (crash / potential use-after-free) rather than trivial remote code execution, and there is no public exploit identified at time of analysis; EPSS is very low (0.03%).

Earlier versions of this analysis (1)
v1 Mar 12, 2026 - 21:54

In the Linux kernel, the following vulnerability has been resolved:

net/handshake: duplicate handshake cancellations leak socket

When a handshake request is cancelled it is removed from the handshake_net->hn_requests list, but it is still present in the handshake_rhashtbl until it is destroyed.

RemediationAI

Apply the vendor kernel update: on Ubuntu install the fixed kernel packages per USN-8177-1 (https://ubuntu.com/security/notices/USN-8177-1) and reboot; on other distributions upgrade to a stable kernel that contains the backported fix (upstream stable commits 011ae80c49d9bfa5b4336f8bd387cd25c7593663, 15564bd67e2975002f2a8e9defee33e321d3183f, 3c330f1dee3cd92b57e19b9d21dc8ce5970b09be, e1641177e7fb48a0a5a06658d4aab51da6656659 at git.kernel.org). No single upstream tagged release version was provided, so confirm the exact patched build with your distribution. Where immediate patching is not possible, the practical compensating control is to avoid the vulnerable code path: disable or do not deploy TLS for SUNRPC/NFS (do not run tlshd / do not mount with the xprtsec=tls|mtls option), which prevents the handshake-cancellation race entirely - the trade-off is loss of transport encryption for those RPC connections, so use it only where network confidentiality is otherwise assured (e.g. isolated/trusted segments or IPsec). Reducing handshake timeouts or fixing tlshd instability lowers the odds of the double-cancel timeout but is not a reliable fix.

Affected ProductsAI

The Linux kernel is affected in versions that include the net/handshake TLS upcall subsystem (present since the ~6.5 series when kernel TLS handshake support and SUNRPC-over-TLS landed). No exact vulnerable version range or CPE was supplied in the input. Distribution-level exposure is confirmed for Ubuntu, whose advisory USN-8177-1 (https://ubuntu.com/security/notices/USN-8177-1) tracks fixed kernel packages. Upstream stable fixes are recorded at git.kernel.org for multiple stable branches via commits 011ae80c49d9bfa5b4336f8bd387cd25c7593663, 15564bd67e2975002f2a8e9defee33e321d3183f, 3c330f1dee3cd92b57e19b9d21dc8ce5970b09be, and e1641177e7fb48a0a5a06658d4aab51da6656659. A third-party summary is available at VulDB (https://vuldb.com/?id.340667).

Affects your stack

Find out whether the stacks and servers you run are on an affected version.

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerable code is the kernel handshake request lifecycle in net/handshake (the tls_handshake / AF_HANDSHAKE upcall mechanism introduced to let userspace tlshd negotiate TLS for kernel consumers such as SUNRPC/NFS-over-TLS). Each handshake request lives in two structures: the per-netns hn_requests list and the handshake_rhashtbl rhashtable. On cancellation, remove_pending() unlinks the request from hn_requests but the entry persists in the rhashtable until destruction. A second cancel for the same request makes remove_pending() return false, yet because HANDSHAKE_F_REQ_COMPLETED is not set the code still follows the out_true path and calls sock_put() again - an unbalanced reference release. The root-cause class is a reference-counting error (CWE-911 'Release of Invalid Pointer or Reference' / CWE-416 use-after-free), even though the NVD CWE field is unpopulated and the vendor tag mislabels it as 'Information Disclosure'. The fix adds test_and_set_bit(HANDSHAKE_F_REQ_COMPLETED) in the pending-cancel path so a duplicate cancel is detected and the second sock_put() is skipped.

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–Critical)
Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 5.9 MEDIUM

Remote peer/timeout triggers the bug (AV:N, PR:N) but it needs a handshake-cancellation race (AC:H); realistic impact is a kernel crash/DoS (A:H), with no confirmed confidentiality or integrity effect.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE 5.9 MEDIUM
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat 3.3 LOW

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

3
Analysis Updated
Jul 30, 2026 - 06:48 vuln.today
v2 - CVSS changed
CVSS changed
Jul 30, 2026 - 06:37 NVD
9.8 (CRITICAL)
CVE Published
Jan 13, 2026 - 16:15 nvd
N/A

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net/handshake: duplicate handshake cancellations leak socket

When a handshake request is cancelled it is removed from the handshake_net->hn_requests list, but it is still present in the handshake_rhashtbl until it is destroyed.

If a second cancellation request arrives for the same handshake request, then remove_pending() will return false... and assuming HANDSHAKE_F_REQ_COMPLETED isn't set in req->hr_flags, we'll continue processing through the out_true label, where we put another reference on the sock and a refcount underflow occurs.

This can happen for example if a handshake times out - particularly if the SUNRPC client sends the AUTH_TLS probe to the server but doesn't follow it up with the ClientHello due to a problem with tlshd. When the timeout is hit on the server, the server will send a FIN, which triggers a cancellation request via xs_reset_transport(). When the timeout is hit on the client, another cancellation request happens via xs_tls_handshake_sync().

Add a test_and_set_bit(HANDSHAKE_F_REQ_COMPLETED) in the pending cancel path so duplicate cancels can be detected.

Executive ViewAI

Why It Matters

A critical memory-safety vulnerability in the Linux kernel's TLS handshake subsystem (CVE-2025-68775, CVSS 9.8) can cause kernel crashes when duplicate handshake requests are canceled, potentially disrupting systems dependent on in-kernel TLS operations. Organizations running production Linux infrastructure supporting SUNRPC-over-TLS services-including NFS deployments and RPC-based applications-face service availability risk if systems encounter the rare condition of simultaneous handshake timeouts. A vendor patch is now available and should be deployed immediately to eliminate this kernel stability threat.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 93% exploitable
Prevalence
High
Linux kernel is ubiquitous but the TLS handshake/RPC-over-TLS code path is niche
Data Quality
5 sources
Confidence: Medium
NVD CVE.org EPSS Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
Yes
Human Impact
High

Priority Score

49
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +49
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-662 – Improper Synchronization

View all
CVE-2020-12769 MEDIUM POC
5.5
CVE-2024-32644 CRITICAL
9.1
CVE-2026-63832 HIGH
8.8
CVE-2016-8368 HIGH
8.6
CVE-2026-68149 HIGH
8.4
CVE-2019-15031 MEDIUM POC
4.4
CVE-2026-72057 HIGH
8.2
CVE-2026-43466 HIGH
8.2

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
Container suse/sl-micro/6.0/baremetal-os-container:latest Container suse/sl-micro/6.0/toolbox:latest Affected
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.95 Image SL-Micro Image SLE-Micro Image SLE-Micro-Azure Image SLE-Micro-BYOS Image SLE-Micro-BYOS-Azure Image SLE-Micro-BYOS-EC2 Image SLE-Micro-BYOS-GCE Image SLE-Micro-EC2 Image SLE-Micro-GCE Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.115 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.146 Affected
Container suse/sl-micro/6.1/base-os-container:2.2.1-5.80 Image SL-Micro-Azure Image SL-Micro-BYOS-Azure Image SL-Micro-BYOS-EC2 Image SL-Micro-BYOS-GCE Image SL-Micro-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-Azure Image SUSE-Multi-Linux-Manager-Proxy-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Proxy-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-Azure-llc Image SUSE-Multi-Linux-Manager-Server-Azure-ltd Image SUSE-Multi-Linux-Manager-Server-BYOS-Azure Image SUSE-Multi-Linux-Manager-Server-BYOS-EC2 Image SUSE-Multi-Linux-Manager-Server-BYOS-GCE Image SUSE-Multi-Linux-Manager-Server-EC2-llc Image SUSE-Multi-Linux-Manager-Server-EC2-ltd Affected

References

Advisories & patches
ADVISORY https://ubuntu.com/security/notices/USN-8177-1 ADVISORY https://vuldb.com/?id.340667 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0447/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0471/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0472/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:0587/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20477/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20479/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20498/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20520/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20555/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20570/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20599/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20615/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20772/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20794/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20819/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20845/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20872/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:20876/ REF https://git.kernel.org/stable/c/011ae80c49d9bfa5b4336f8bd387cd25c7593663 REF https://git.kernel.org/stable/c/15564bd67e2975002f2a8e9defee33e321d3183f REF https://git.kernel.org/stable/c/3c330f1dee3cd92b57e19b9d21dc8ce5970b09be REF https://git.kernel.org/stable/c/e1641177e7fb48a0a5a06658d4aab51da6656659

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy