EUVD-2026-76442
GHSA-fhrg-h295-8p3m
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local, config-gated trigger via a timing race (AV:L/AC:H), requires an unprivileged local actor or operational condition to initiate the handshake (PR:L), and the realistic impact is a kernel crash (A:H only).
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
SUNRPC: wait for in-flight client TLS handshake callback
xs_tls_handshake_sync() gives xs_tls_handshake_done() a reference to the lower transport before submitting the handshake request. On timeout or signal, the synchronous waiter drops that reference after calling tls_handshake_cancel().
handshake_req_cancel() returns false when handshake_complete() has already marked the request complete. In that case the completion callback can still be running, so dropping the callback-owned reference in the waiter can free the lower transport before xs_tls_handshake_done() stores xprt_err or drops its own reference.
If cancellation loses to completion, wait until xs_tls_handshake_done() signals handshake_done and let the callback release its reference. This mirrors the server-side handshake lifetime handling and keeps the timeout or signal return value unchanged.
AnalysisAI
A use-after-free race condition in the Linux kernel's SUNRPC client-side TLS handshake path (introduced in 6.5) allows the lower RPC transport to be freed while the xs_tls_handshake_done() completion callback is still running. When a synchronous handshake waiter times out or is signaled and tls_handshake_cancel() loses the race to handshake completion, the waiter drops the callback-owned reference, freeing the transport before the callback stores xprt_err or releases its own reference. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The affected host must be configured as an RPC-over-TLS client - in practice NFS mounts using xprtsec=tls or xprtsec=mtls on a kernel between 6.5 and the fixed versions. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The published CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) substantially overstates real-world risk and appears to be a generic auto-assigned kernel score. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch by upgrading to a fixed kernel: 6.12.109, 6.18.50, 7.2.4, or 7.3-rc1 (or later), matching your maintained stable series; the fix makes the waiter wait for handshake_done and lets the completion callback release its own reference, mirroring the server-side lifetime handling. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit systems running NFS with RPC-over-TLS configuration (grep /etc/fstab for xprtsec=tls and check /proc/mounts) to identify affected infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today