CVE-2026-72222 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
sunrpc: pin svc_xprt across the asynchronous TLS handshake callback
svc_tcp_handshake() stores the raw svc_xprt pointer in tls_handshake_args.ta_data and submits the request through tls_server_hello_x509(). The handshake core takes only sock_hold(req->hr_sk); nothing references the embedding struct svc_sock that svc_tcp_handshake_done() reaches via container_of().
Two close races leave the in-flight callback writing through a freed svc_sock. svc_sock_free() calls tls_handshake_cancel() and discards its return value: a false return means handshake_complete() has already set HANDSHAKE_F_REQ_COMPLETED but hp_done() may not have finished, yet svc_sock_free() proceeds to kfree(svsk). The cancel-loser fall-through inside svc_tcp_handshake() itself produces the same window: when wait_for_completion_interruptible_timeout() returns <= 0 (timeout or signal) and tls_handshake_cancel() returns false, the function does not drain, returns, and svc_handle_xprt() calls svc_xprt_received(), which clears XPT_BUSY and can drop the last reference. A concurrent close then runs svc_sock_free() while svc_tcp_handshake_done() is still updating xpt_flags and walking svsk->sk_handshake_done.
The corruption surfaces as set_bit/clear_bit RMW into the freed xpt_flags slab slot and as complete_all() walking and writing the freed wait_queue_head_t list embedded in sk_handshake_done -- a slab-corruption primitive, not a benign read. The path is reachable on any TLS-enabled NFS server whenever a connection close overlaps the tlshd downcall delivery window; the interruptible wait means signal delivery suffices, not just SVC_HANDSHAKE_TO expiry.
Take svc_xprt_get(xprt) immediately before tls_server_hello_x509() so the in-flight callback owns its own reference. Release it on the two edges where the callback is guaranteed not to fire -- submission failure from tls_server_hello_x509() and a successful tls_handshake_cancel() -- and at the tail of svc_tcp_handshake_done() after complete_all().
[cel: rewrote commit message to describe the actual change]
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability described represents a critical race condition in the Linux kernel's sunrpc implementation that affects TLS-enabled NFS servers. This flaw stems from improper reference management during asynchronous TLS handshake operations, creating a window where memory corruption can occur through use-after-free conditions. The issue manifests when the svc_tcp_handshake() function stores a raw svc_xprt pointer within tls_handshake_args.ta_data and submits the request through tls_server_hello_x509(), but fails to maintain proper reference counting throughout the asynchronous operation lifecycle.
The technical flaw involves two distinct race windows that can lead to memory corruption. First, svc_sock_free() invokes tls_handshake_cancel() and ignores its return value, creating a scenario where handshake_complete() may have already set HANDSHAKE_F_REQ_COMPLETED while hp_done() has not yet finished processing. This allows svc_sock_free() to proceed with kfree(svsk) before all operations on the freed structure complete. Second, within svc_tcp_handshake(), when wait_for_completion_interruptible_timeout() returns zero or negative values indicating timeout or signal delivery, and tls_handshake_cancel() returns false, the function exits without proper draining, leaving the svc_xprt in an inconsistent state where svc_handle_xprt() can clear XPT_BUSY and drop the final reference.
The operational impact of this vulnerability extends beyond simple memory corruption to include potential system instability and privilege escalation risks. The corruption occurs through set_bit/clear_bit read-modify-write operations into freed xpt_flags slab slots, as well as complete_all() walking and writing to freed wait_queue_head_t lists embedded in sk_handshake_done. This constitutes a slab-corruption primitive rather than benign read errors, making it particularly dangerous for server environments where persistent connections and concurrent access patterns increase the probability of triggering these race conditions. The vulnerability is reachable whenever connection close operations overlap with TLS handshake downcall delivery windows, with signal delivery sufficient to trigger the problematic code path rather than requiring explicit timeout expiration.
The mitigation strategy involves implementing proper reference counting by taking svc_xprt_get(xprt) immediately before tls_server_hello_x509() so that the in-flight callback owns its own reference. This ensures that even if the parent svc_sock structure is freed during the handshake process, the callback can safely access the svc_xprt without causing memory corruption. The reference must be released at two specific edges: when submission fails from tls_server_hello_x509() and when a successful tls_handshake_cancel() occurs, plus at the tail of svc_tcp_handshake_done() after complete_all() has completed processing. This approach addresses the root cause by ensuring that all references to svc_xprt remain valid throughout the asynchronous handshake lifecycle, preventing the use-after-free conditions that lead to memory corruption. The fix aligns with established security practices for managing reference counts in concurrent systems and prevents the specific race conditions identified in the vulnerability description.
This vulnerability pattern relates to CWE-415: Double Free and CWE-416: Use After Free, while the operational characteristics align with ATT&CK technique T1059.001: Command and Scripting Interpreter - PowerShell for potential exploitation scenarios. The race condition specifically targets kernel memory management patterns that are common in network service implementations, making it particularly relevant to server environments where concurrent connection handling and TLS operations are prevalent.