CVE-2026-72222: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback

Published Aug 15, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

sunrpc: pin svcxprt across the asynchronous TLS handshake callback

svctcphandshake() stores the raw svcxprt pointer in tlshandshakeargs.tadata and submits the request through tlsserverhellox509(). The handshake core takes only sockhold(req->hrsk); nothing references the embedding struct svcsock that svctcphandshakedone() reaches via containerof().

Two close races leave the in-flight callback writing through a freed svcsock. svcsockfree() calls tlshandshakecancel() and discards its return value: a false return means handshakecomplete() has already set HANDSHAKEFREQCOMPLETED but hpdone() may not have finished, yet svcsockfree() proceeds to kfree(svsk). The cancel-loser fall-through inside svctcphandshake() itself produces the same window: when waitforcompletioninterruptibletimeout() returns <= 0 (timeout or signal) and tlshandshakecancel() returns false, the function does not drain, returns, and svchandlexprt() calls svcxprtreceived(), which clears XPTBUSY and can drop the last reference. A concurrent close then runs svcsockfree() while svctcphandshakedone() is still updating xptflags and walking svsk->skhandshakedone.

The corruption surfaces as setbit/clearbit RMW into the freed xptflags slab slot and as completeall() walking and writing the freed waitqueueheadt list embedded in skhandshakedone -- a slab-corruption primitive, not a benign read. The path is reachable on any TLS-enabled NFS server whenever a connection close overlaps the tlshd downcall delivery window; the interruptible wait means signal delivery suffices, not just SVCHANDSHAKETO expiry.

Take svcxprtget(xprt) immediately before tlsserverhellox509() so the in-flight callback owns its own reference. Release it on the two edges where the callback is guaranteed not to fire -- submission failure from tlsserverhellox509() and a successful tlshandshakecancel() -- and at the tail of svctcphandshakedone() after completeall().

[cel: rewrote commit message to describe the actual change]

Event History

Aug 15, 2026
CVE Published
via MITRE·05:54 AM
Data Sourced
via MITRE·05:54 AM
Description
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203