EUVD-2026-59417
GHSA-fc6x-h5h8-wjr3
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local low-privileged attacker sends forged netlink message; high C/I/A because TLS authentication bypass enables session impersonation, data exposure, and handshake disruption.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
handshake: Require admin permission for DONE command
ACCEPT and DONE are the two downcalls of the handshake genl family, both intended for use by the trusted handshake agent (tlshd). ACCEPT already requires GENL_ADMIN_PERM; DONE has no privilege check at all.
The fd-lookup in handshake_nl_done_doit() only confirms that some pending handshake request exists for the supplied sockfd; it does not authenticate the sender. An unprivileged process that guesses or observes a valid sockfd can therefore submit a DONE with HANDSHAKE_A_DONE_STATUS == 0, leaving the kernel consumer to proceed as if the handshake succeeded. A non-zero status on a forged DONE tears down a legitimate in-flight handshake before tlshd can report its real result.
AnalysisAI
Missing authorization on the handshake genl family's DONE downcall in Linux kernel 6.4 and later allows a local low-privileged process to forge TLS handshake completion signals to the kernel's TLS infrastructure. Any unprivileged user that can observe or guess a valid sockfd associated with an in-flight handshake request can submit a crafted DONE message - either with STATUS=0 to make the kernel consumer accept a session as if TLS authentication succeeded, or with a non-zero status to abort a legitimate handshake before the trusted agent tlshd can report its real result. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) the attacker must have a local unprivileged account on the target system - remote unauthenticated exploitation is not possible given AV:L in the CVSS vector; (2) the system must be actively running the kernel TLS handshake subsystem with tlshd, meaning kTLS-based workloads such as NFS-over-TLS must be in use - kernels with the handshake module compiled but no active handshake sessions are not exploitable; (3) the attacker must obtain or guess a valid sockfd value associated with a currently pending handshake request, which requires either timing observation via /proc or filesystem side-channels, or brute-force iteration over the fd namespace. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.8 High score (AV:L/AC:L/PR:L/UI:N) accurately reflects a local attack requiring only a low-privileged account, with high impact across confidentiality, integrity, and availability due to the TLS authentication-bypass nature of the flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local unprivileged user on an NFS-over-TLS or kTLS-enabled Linux server monitors open file descriptors (e.g., via /proc/net or timing observations) to identify a sockfd currently undergoing a TLS handshake managed by tlshd. The attacker then sends a crafted Generic Netlink DONE message specifying that sockfd with HANDSHAKE_A_DONE_STATUS=0, which the kernel accepts without privilege verification. … |
| Remediation | Upgrade to patched Linux kernel releases: 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc1 as applicable. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Inventory all Linux systems running kernel version 6.4 or later and assess patch availability from your Linux vendor. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today