---
id: CVE-2026-72221
title: 'sunrpc: wait for in-flight TLS handshake callback when cancel loses race'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  sunrpc: wait for in-flight TLS handshake callback when cancel loses race

  When wait_for_completion_interruptible_timeout() in
  svc_tcp_handshake() returns 0 (timeout) or…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= b3cbf98e2fdf3cb147a95161560cd25987284330 <
    0d8ceb39884148dc7a2fdf71e1cac5961ed1d2b9
  - >-
    Linux >= b3cbf98e2fdf3cb147a95161560cd25987284330 <
    e0f4691d42a54d359d8b64509fd9ab938d4f2a33
  - >-
    Linux >= b3cbf98e2fdf3cb147a95161560cd25987284330 <
    65b23bec1fca6e9ebdc3e6041ebf8c6ab074141b
  - >-
    Linux >= b3cbf98e2fdf3cb147a95161560cd25987284330 <
    a4f878e8ecd729ccf2e50993444e217583adeace
  - >-
    Linux >= b3cbf98e2fdf3cb147a95161560cd25987284330 <
    d00e32f84ca1a77cb67a3fbf59f58dada95f5a21
  - Linux 6.4
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T18:43:57.343257Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:45:02.148Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72221'
references:
  - url: 'https://git.kernel.org/stable/c/0d8ceb39884148dc7a2fdf71e1cac5961ed1d2b9'
  - url: 'https://git.kernel.org/stable/c/e0f4691d42a54d359d8b64509fd9ab938d4f2a33'
  - url: 'https://git.kernel.org/stable/c/65b23bec1fca6e9ebdc3e6041ebf8c6ab074141b'
  - url: 'https://git.kernel.org/stable/c/a4f878e8ecd729ccf2e50993444e217583adeace'
  - url: 'https://git.kernel.org/stable/c/d00e32f84ca1a77cb67a3fbf59f58dada95f5a21'
tags:
  - cve.org
epss: 0.00635
epssPercentile: 0.49342
ingestedAt: '2026-10-16T19:46:24.422Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

sunrpc: wait for in-flight TLS handshake callback when cancel loses race

When wait_for_completion_interruptible_timeout() in
svc_tcp_handshake() returns 0 (timeout) or -ERESTARTSYS (signal) and
tls_handshake_cancel() then returns false, handshake_complete() has
won the cancellation race: it has set HANDSHAKE_F_REQ_COMPLETED and
is about to invoke svc_tcp_handshake_done(), but the callback's
side effects on xpt_flags and on svsk->sk_handshake_done have not
yet committed.

The current code reads xpt_flags immediately to decide whether the
session succeeded. Two races result.

If the callback has executed set_bit(XPT_TLS_SESSION) but not yet
clear_bit(XPT_HANDSHAKE), svc_tcp_handshake() sees a session,
enqueues the transport, and returns. svc_xprt_received() then
clears XPT_BUSY, a worker thread picks the transport up, the
dispatcher in svc_handle_xprt() observes XPT_HANDSHAKE still set,
and xpo_handshake is invoked a second time. That svc_tcp_handshake()
calls init_completion(&svsk->sk_handshake_done) while the original
callback concurrently calls complete_all() on it, corrupting the
embedded swait_queue.

If the callback has set HANDSHAKE_F_REQ_COMPLETED but not yet
entered svc_tcp_handshake_done(), svc_tcp_handshake() reads
XPT_TLS_SESSION as clear and tears the connection down even though
the handshake is about to succeed.

Wait for the callback to commit before inspecting xpt_flags. The
completion is guaranteed to fire because handshake_complete()
invokes svc_tcp_handshake_done() unconditionally once it has set
HANDSHAKE_F_REQ_COMPLETED.

## Affected

- `Linux >= b3cbf98e2fdf3cb147a95161560cd25987284330 < 0d8ceb39884148dc7a2fdf71e1cac5961ed1d2b9`
- `Linux >= b3cbf98e2fdf3cb147a95161560cd25987284330 < e0f4691d42a54d359d8b64509fd9ab938d4f2a33`
- `Linux >= b3cbf98e2fdf3cb147a95161560cd25987284330 < 65b23bec1fca6e9ebdc3e6041ebf8c6ab074141b`
- `Linux >= b3cbf98e2fdf3cb147a95161560cd25987284330 < a4f878e8ecd729ccf2e50993444e217583adeace`
- `Linux >= b3cbf98e2fdf3cb147a95161560cd25987284330 < d00e32f84ca1a77cb67a3fbf59f58dada95f5a21`
- `Linux 6.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.