---
id: CVE-2025-68775
title: 'net/handshake: duplicate handshake cancellations leak socket'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/handshake: duplicate handshake cancellations leak socket

  When a handshake request is cancelled it is removed from the
  handshake_net->hn_requests list, but it is st…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 3b3009ea8abb713b022d94fba95ec270cf6e7eae <
    011ae80c49d9bfa5b4336f8bd387cd25c7593663
  - >-
    Linux >= 3b3009ea8abb713b022d94fba95ec270cf6e7eae <
    e1641177e7fb48a0a5a06658d4aab51da6656659
  - >-
    Linux >= 3b3009ea8abb713b022d94fba95ec270cf6e7eae <
    3c330f1dee3cd92b57e19b9d21dc8ce5970b09be
  - >-
    Linux >= 3b3009ea8abb713b022d94fba95ec270cf6e7eae <
    15564bd67e2975002f2a8e9defee33e321d3183f
  - Linux 6.4
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T15:05:12.016818Z'
published: '2026-01-13'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:09:44.643Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-68775'
references:
  - url: 'https://git.kernel.org/stable/c/011ae80c49d9bfa5b4336f8bd387cd25c7593663'
  - url: 'https://git.kernel.org/stable/c/e1641177e7fb48a0a5a06658d4aab51da6656659'
  - url: 'https://git.kernel.org/stable/c/3c330f1dee3cd92b57e19b9d21dc8ce5970b09be'
  - url: 'https://git.kernel.org/stable/c/15564bd67e2975002f2a8e9defee33e321d3183f'
tags:
  - cve.org
epss: 0.00548
epssPercentile: 0.44665
ingestedAt: '2026-10-16T17:24:46.632Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/handshake: duplicate handshake cancellations leak socket

When a handshake request is cancelled it is removed from the
handshake_net->hn_requests list, but it is still present in the
handshake_rhashtbl until it is destroyed.

If a second cancellation request arrives for the same handshake request,
then remove_pending() will return false... and assuming
HANDSHAKE_F_REQ_COMPLETED isn't set in req->hr_flags, we'll continue
processing through the out_true label, where we put another reference on
the sock and a refcount underflow occurs.

This can happen for example if a handshake times out - particularly if
the SUNRPC client sends the AUTH_TLS probe to the server but doesn't
follow it up with the ClientHello due to a problem with tlshd.  When the
timeout is hit on the server, the server will send a FIN, which triggers
a cancellation request via xs_reset_transport().  When the timeout is
hit on the client, another cancellation request happens via
xs_tls_handshake_sync().

Add a test_and_set_bit(HANDSHAKE_F_REQ_COMPLETED) in the pending cancel
path so duplicate cancels can be detected.

## Affected

- `Linux >= 3b3009ea8abb713b022d94fba95ec270cf6e7eae < 011ae80c49d9bfa5b4336f8bd387cd25c7593663`
- `Linux >= 3b3009ea8abb713b022d94fba95ec270cf6e7eae < e1641177e7fb48a0a5a06658d4aab51da6656659`
- `Linux >= 3b3009ea8abb713b022d94fba95ec270cf6e7eae < 3c330f1dee3cd92b57e19b9d21dc8ce5970b09be`
- `Linux >= 3b3009ea8abb713b022d94fba95ec270cf6e7eae < 15564bd67e2975002f2a8e9defee33e321d3183f`
- `Linux 6.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.