CVE-2026-72222: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback

Published Aug 15, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

sunrpc: pin svcxprt across the asynchronous TLS handshake callback

svctcphandshake() stores the raw svcxprt pointer in tlshandshakeargs.tadata and submits the request through tlsserverhellox509(). The handshake core takes only sockhold(req->hrsk); nothing references the embedding struct svcsock that svctcphandshakedone() reaches via containerof().

Two close races leave the in-flight callback writing through a freed svcsock. svcsockfree() calls tlshandshakecancel() and discards its return value: a false return means handshakecomplete() has already set HANDSHAKEFREQCOMPLETED but hpdone() may not have finished, yet svcsockfree() proceeds to kfree(svsk). The cancel-loser fall-through inside svctcphandshake() itself produces the same window: when waitforcompletioninterruptibletimeout() returns <= 0 (timeout or signal) and tlshandshakecancel() returns false, the function does not drain, returns, and svchandlexprt() calls svcxprtreceived(), which clears XPTBUSY and can drop the last reference. A concurrent close then runs svcsockfree() while svctcphandshakedone() is still updating xptflags and walking svsk->skhandshakedone.

The corruption surfaces as setbit/clearbit RMW into the freed xptflags slab slot and as completeall() walking and writing the freed waitqueueheadt list embedded in skhandshakedone -- a slab-corruption primitive, not a benign read. The path is reachable on any TLS-enabled NFS server whenever a connection close overlaps the tlshd downcall delivery window; the interruptible wait means signal delivery suffices, not just SVCHANDSHAKETO expiry.

Take svcxprtget(xprt) immediately before tlsserverhellox509() so the in-flight callback owns its own reference. Release it on the two edges where the callback is guaranteed not to fire -- submission failure from tlsserverhellox509() and a successful tlshandshakecancel() -- and at the tail of svctcphandshakedone() after completeall().

[cel: rewrote commit message to describe the actual change]

Affected Software

162 affected componentsFixes available
Linux Kernel
ubuntu/linux-hwe-edge*
ubuntu/linux-aws-5.0*
ubuntu/linux-aws-5.3*
ubuntu/linux-azure*
ubuntu/linux-azure-5.3*
ubuntu/linux-azure-edge*
ubuntu/linux-gcp*
ubuntu/linux-gcp-5.3*
ubuntu/linux-gke-4.15*
ubuntu/linux-gke-5.4*
ubuntu/linux-gkeop-5.4*
ubuntu/linux-hwe*
ubuntu/linux-hwe-edge*
ubuntu/linux-oem*
ubuntu/linux-oracle-5.0*
ubuntu/linux-oracle-5.3*
ubuntu/linux-aws-5.11*
ubuntu/linux-aws-5.13*
ubuntu/linux-aws-5.8*
ubuntu/linux-azure-5.11*
ubuntu/linux-azure-5.13*
ubuntu/linux-azure-5.8*
ubuntu/linux-azure-fde*
ubuntu/linux-gcp-5.11*
ubuntu/linux-gcp-5.13*
ubuntu/linux-gcp-5.8*
ubuntu/linux-gke*
ubuntu/linux-gke-5.15*
ubuntu/linux-gkeop*
ubuntu/linux-gkeop-5.15*
ubuntu/linux-hwe-5.11*
ubuntu/linux-hwe-5.13*
ubuntu/linux-hwe-5.8*
ubuntu/linux-intel-5.13*
ubuntu/linux-oem-5.10*
ubuntu/linux-oem-5.13*
ubuntu/linux-oem-5.6*
ubuntu/linux-oracle-5.11*
ubuntu/linux-oracle-5.13*
ubuntu/linux-oracle-5.8*
ubuntu/linux-raspi2*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.11*
ubuntu/linux-riscv-5.8*
ubuntu/linux-allwinner-5.19*
ubuntu/linux-aws-5.19*
ubuntu/linux-aws-6.2*
ubuntu/linux-aws-6.5*
ubuntu/linux-aws-6.8*
ubuntu/linux-azure-5.19*
ubuntu/linux-azure-6.2*
ubuntu/linux-azure-6.5*
ubuntu/linux-azure-6.8*
ubuntu/linux-azure-fde-5.19*
ubuntu/linux-azure-fde-6.2*
ubuntu/linux-azure-fde-6.8*
ubuntu/linux-gcp-5.19*
ubuntu/linux-gcp-6.2*
ubuntu/linux-gcp-6.5*
ubuntu/linux-gcp-6.8*
ubuntu/linux-hwe-5.19*
ubuntu/linux-hwe-6.2*
ubuntu/linux-hwe-6.5*
ubuntu/linux-ibm-6.8*
ubuntu/linux-intel-iot-realtime*
ubuntu/linux-lowlatency-hwe-5.19*
ubuntu/linux-lowlatency-hwe-6.2*
ubuntu/linux-lowlatency-hwe-6.5*
ubuntu/linux-lowlatency-hwe-6.8*
ubuntu/linux-nvidia-6.2*
ubuntu/linux-nvidia-6.5*
ubuntu/linux-nvidia-6.8*
ubuntu/linux-oem-5.17*
ubuntu/linux-oem-6.0*
ubuntu/linux-oem-6.1*
ubuntu/linux-oem-6.5*
ubuntu/linux-oracle-6.5*
ubuntu/linux-oracle-6.8*
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.19*
ubuntu/linux-riscv-6.5*
ubuntu/linux-riscv-6.8*
ubuntu/linux-starfive-5.19*
ubuntu/linux-starfive-6.2*
ubuntu/linux-starfive-6.5*
ubuntu/linux-realtime-6.8*
ubuntu/linux<6.8.0-147.147
6.8.0-147.147
ubuntu/linux-aws<6.8.0-1067.70
6.8.0-1067.70
ubuntu/linux-aws-6.14*
ubuntu/linux-aws-6.17*
ubuntu/linux-aws-7.0<7.0.0-1013.13~24.04.1
7.0.0-1013.13~24.04.1
ubuntu/linux-azure<6.8.0-1071.79
6.8.0-1071.79
ubuntu/linux-azure-6.11*
ubuntu/linux-azure-6.14*
ubuntu/linux-azure-6.17*
ubuntu/linux-azure-7.0<7.0.0-1017.17~24.04.1
7.0.0-1017.17~24.04.1
ubuntu/linux-azure-fde<6.8.0-1069.76
6.8.0-1069.76
ubuntu/linux-azure-fde-6.14*
ubuntu/linux-azure-fde-6.17*
ubuntu/linux-azure-fde-7.0<7.0.0-1016.16~24.04.1
7.0.0-1016.16~24.04.1
ubuntu/linux-azure-nvidia*
ubuntu/linux-azure-nvidia-6.14*
ubuntu/linux-gcp<6.8.0-1071.79
6.8.0-1071.79
ubuntu/linux-gcp-6.11*
ubuntu/linux-gcp-6.14*
ubuntu/linux-gcp-7.0<7.0.0-1013.13~24.04.1
7.0.0-1013.13~24.04.1
ubuntu/linux-gke<6.8.0-1066.74
6.8.0-1066.74
ubuntu/linux-gkeop<6.8.0-1052.56
6.8.0-1052.56
ubuntu/linux-hwe-6.11*
ubuntu/linux-hwe-6.14*
ubuntu/linux-hwe-6.17*
ubuntu/linux-hwe-7.0<7.0.0-34.34~24.04.1
7.0.0-34.34~24.04.1
ubuntu/linux-ibm<6.8.0-1067.68
6.8.0-1067.68
ubuntu/linux-lowlatency<6.8.0-147.147.1
6.8.0-147.147.1
ubuntu/linux-lowlatency-hwe-6.11*
ubuntu/linux-nvidia*
ubuntu/linux-nvidia-6.11*
ubuntu/linux-nvidia-6.17*
ubuntu/linux-nvidia-7.0*
ubuntu/linux-nvidia-lowlatency*
ubuntu/linux-nvidia-tegra<6.8.0-1035.38
6.8.0-1035.38
ubuntu/linux-oem-6.11*
ubuntu/linux-oem-6.14*
ubuntu/linux-oem-6.17*
ubuntu/linux-oem-6.8*
ubuntu/linux-oracle<6.8.0-1064.67
6.8.0-1064.67
ubuntu/linux-oracle-6.14*
ubuntu/linux-oracle-6.17*
ubuntu/linux-oracle-7.0<7.0.0-1012.12~24.04.1
7.0.0-1012.12~24.04.1
ubuntu/linux-raspi*
ubuntu/linux-raspi-realtime*
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-6.14*
ubuntu/linux-riscv-6.17*
ubuntu/linux-riscv-7.0<7.0.0-34.34.1~24.04.1
7.0.0-34.34.1~24.04.1
ubuntu/linux-xilinx*
ubuntu/linux-bluefield<6.8.0-1033.38
6.8.0-1033.38
ubuntu/linux-raspi-realtime*
ubuntu/linux-realtime<6.8.1-1062.63
6.8.1-1062.63
ubuntu/linux-realtime-6.14*
ubuntu/linux-realtime-6.17*
ubuntu/linux-aws-fips<6.8.0-1067.70+fips1
6.8.0-1067.70+fips1
ubuntu/linux-azure-fips<6.8.0-1071.79+fips1
6.8.0-1071.79+fips1
ubuntu/linux-fips<6.8.0-147.147+fips1
6.8.0-147.147+fips1
ubuntu/linux-gcp-fips<6.8.0-1071.79+fips1
6.8.0-1071.79+fips1
ubuntu/linux<7.0.0-34.34
7.0.0-34.34
ubuntu/linux-aws<7.0.0-1013.13
7.0.0-1013.13
ubuntu/linux-azure<7.0.0-1017.17
7.0.0-1017.17
ubuntu/linux-azure-fde<7.0.0-1016.16
7.0.0-1016.16
ubuntu/linux-gcp<7.0.0-1013.13
7.0.0-1013.13
ubuntu/linux-gke<7.0.0-1007.8
7.0.0-1007.8
ubuntu/linux-ibm<7.0.0-1014.14
7.0.0-1014.14
ubuntu/linux-nvidia*
ubuntu/linux-nvidia-bos*
ubuntu/linux-oem-7.0<7.0.0-1014.14
7.0.0-1014.14
ubuntu/linux-oracle<7.0.0-1012.12
7.0.0-1012.12
ubuntu/linux-raspi<7.0.0-1020.20
7.0.0-1020.20
ubuntu/linux-realtime<7.0.0-34.34.1
7.0.0-34.34.1
ubuntu/linux-riscv<7.0.0-34.34.1
7.0.0-34.34.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 6.8.0-147.147
  2. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 6.8.0-1067.70
  3. Upgrade

    Upgrade ubuntu/linux-aws-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-1013.13~24.04.1
  4. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 6.8.0-1071.79
  5. Upgrade

    Upgrade ubuntu/linux-azure-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-1017.17~24.04.1
  6. Upgrade

    Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.

    Fixed in 6.8.0-1069.76
  7. Upgrade

    Upgrade ubuntu/linux-azure-fde-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-1016.16~24.04.1
  8. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 6.8.0-1071.79
  9. Upgrade

    Upgrade ubuntu/linux-gcp-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-1013.13~24.04.1
  10. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 6.8.0-1066.74
  11. Upgrade

    Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.

    Fixed in 6.8.0-1052.56
  12. Upgrade

    Upgrade ubuntu/linux-hwe-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-34.34~24.04.1
  13. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 6.8.0-1067.68
  14. Upgrade

    Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.

    Fixed in 6.8.0-147.147.1
  15. Upgrade

    Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.

    Fixed in 6.8.0-1035.38
  16. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 6.8.0-1064.67
  17. Upgrade

    Upgrade ubuntu/linux-oracle-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-1012.12~24.04.1
  18. Upgrade

    Upgrade ubuntu/linux-riscv-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-34.34.1~24.04.1
  19. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 6.8.0-1033.38
  20. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 6.8.1-1062.63
  21. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1067.70+fips1
  22. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1071.79+fips1
  23. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-147.147+fips1
  24. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 6.8.0-1071.79+fips1
  25. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 7.0.0-34.34
  26. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 7.0.0-1013.13
  27. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 7.0.0-1017.17
  28. Upgrade

    Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.

    Fixed in 7.0.0-1016.16
  29. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 7.0.0-1013.13
  30. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 7.0.0-1007.8
  31. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 7.0.0-1014.14
  32. Upgrade

    Upgrade ubuntu/linux-oem-7.0 to a version that resolves this vulnerability.

    Fixed in 7.0.0-1014.14
  33. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 7.0.0-1012.12
  34. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 7.0.0-1020.20
  35. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 7.0.0-34.34.1
  36. Upgrade

    Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.

    Fixed in 7.0.0-34.34.1

Event History

Aug 15, 2026
CVE Published
via MITRE·05:54 AM
Data Sourced
via MITRE·05:54 AM
DescriptionSeverity
Data Sourced
via OSV·06:21 AM
DescriptionSeverityAffected Software
Data Sourced
via NVD·06:21 AM
DescriptionSeverity

Frequently Asked Questions

1

What is the severity of CVE-2026-72222?

CVE-2026-72222 has a risk score of 60, indicating a medium level of severity.

2

How do I fix CVE-2026-72222?

To fix CVE-2026-72222, upgrade to the latest version of the Linux kernel where this vulnerability has been resolved.

3

What impact does CVE-2026-72222 have on system security?

CVE-2026-72222 can potentially allow an attacker to exploit the TLS handshake process, leading to various security issues.

4

Where does CVE-2026-72222 occur?

CVE-2026-72222 occurs in the Linux kernel's sunrpc subsystem during the asynchronous TLS handshake callback.

5

Is CVE-2026-72222 related to TLS vulnerabilities?

Yes, CVE-2026-72222 involves a security issue during the TLS handshake process in the sunrpc implementation.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203