Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Linux kernel may crash during TLS handshake cancellation

CVE-2026-63979 · published 3 months ago
Summary

The Linux kernel code that handles TLS handshakes could access memory that has already been freed when a handshake is cancelled, potentially causing a system crash or instability. This issue affects various Linux kernel packages, including standard and distribution-specific builds. Update your Linux kernel to the latest patched version to prevent the problem.

What to do
  • Update linux kernel to version 7.0.12.
  • Update debian rootio-linux to version 6.12.96-1.aikido.154.
  • Update canonical linux-hwe-7.0 to version 7.0.0-28.28~24.04.1.
  • Update canonical linux-nvidia-7.0 to version 7.0.0-1016.16~24.04.1.
  • Update canonical linux-riscv-7.0 to version 7.0.0-28.28.1~24.04.3.
  • Update canonical linux to version 7.0.0-28.28.
  • Update canonical linux-aws to version 7.0.0-1009.9.
  • Update canonical linux-azure to version 7.0.0-1010.10.
  • Update canonical linux-azure-fde to version 7.0.0-1009.9.
  • Update canonical linux-gcp to version 7.0.0-1008.8.
  • Update canonical linux-gke to version 7.0.0-1003.4.
  • Update canonical linux-ibm to version 7.0.0-1010.10.
  • Update canonical linux-nvidia to version 7.0.0-1016.16.
  • Update canonical linux-nvidia-bos to version 7.0.0-2016.16.
  • Update canonical linux-oem-7.0 to version 7.0.0-1009.9.
  • Update canonical linux-oracle to version 7.0.0-1008.8.
  • Update canonical linux-raspi to version 7.0.0-1015.15.
  • Update canonical linux-realtime to version 7.0.0-28.28.1.
  • Update canonical linux-riscv to version 7.0.0-28.28.1.
  • Update debian linux to version 7.0.12-1.
  • Update canonical linux-azure-7.0 to version 7.0.0-1014.14~24.04.1.
  • Update canonical linux-gcp-7.0 to version 7.0.0-1011.11~24.04.1.
  • Update canonical linux-nvidia-tegra to version 6.8.0-1035.38.
  • Update canonical linux-oracle-7.0 to version 7.0.0-1011.11~24.04.1.
  • Update linux to version 6.12.113-1.aikido.163.
  • Update rootio-linux to version 6.12.113-1.aikido.163.
  • Update bellsoft linux-lts to version 6.12.115-r0.
  • Update bellsoft linux-lts to version 6.18.46-r0.
Affected software
Ecosystem VendorProductAffected versions
Linux linux kernel >= 6.4.0, < 7.0.12
>= 6.19.0, < 7.0.12
Fix: upgrade to 7.0.12
Root:Debian:13 debian rootio-linux < 6.12.96-1.aikido.154
Fix: upgrade to 6.12.96-1.aikido.154
– linux linux < c06876d4fac38f35820946ee3b1be7d7da799cd4
6.4
< 68eba6519cbd6359fb554a9720f3a3b6b2eba23f
Ubuntu:16.04:LTS canonical linux-hwe-edge All versions
Ubuntu:18.04:LTS canonical linux-aws-5.0 All versions
Ubuntu:18.04:LTS canonical linux-aws-5.3 All versions
Ubuntu:18.04:LTS canonical linux-azure All versions
Ubuntu:18.04:LTS canonical linux-azure-5.3 All versions
Ubuntu:18.04:LTS canonical linux-azure-edge All versions
Ubuntu:18.04:LTS canonical linux-gcp All versions
Ubuntu:18.04:LTS canonical linux-gcp-5.3 All versions
Ubuntu:18.04:LTS canonical linux-gke-4.15 All versions
Ubuntu:18.04:LTS canonical linux-gke-5.4 All versions
Ubuntu:18.04:LTS canonical linux-gkeop-5.4 All versions
Ubuntu:18.04:LTS canonical linux-hwe All versions
Ubuntu:18.04:LTS canonical linux-oem All versions
Ubuntu:18.04:LTS canonical linux-oracle-5.0 All versions
Ubuntu:18.04:LTS canonical linux-oracle-5.3 All versions
Ubuntu:20.04:LTS canonical linux-aws-5.11 All versions
Ubuntu:20.04:LTS canonical linux-aws-5.13 All versions
Ubuntu:20.04:LTS canonical linux-aws-5.8 All versions
Ubuntu:20.04:LTS canonical linux-azure-5.11 All versions
Ubuntu:20.04:LTS canonical linux-azure-5.13 All versions
Ubuntu:20.04:LTS canonical linux-azure-5.8 All versions
Ubuntu:20.04:LTS canonical linux-azure-fde All versions
Ubuntu:20.04:LTS canonical linux-gcp-5.11 All versions
Ubuntu:20.04:LTS canonical linux-gcp-5.13 All versions
Ubuntu:20.04:LTS canonical linux-gcp-5.8 All versions
Ubuntu:20.04:LTS canonical linux-gke All versions
Ubuntu:20.04:LTS canonical linux-gke-5.15 All versions
Ubuntu:20.04:LTS canonical linux-gkeop All versions
Ubuntu:20.04:LTS canonical linux-gkeop-5.15 All versions
Ubuntu:20.04:LTS canonical linux-hwe-5.11 All versions
Ubuntu:20.04:LTS canonical linux-hwe-5.13 All versions
Ubuntu:20.04:LTS canonical linux-hwe-5.8 All versions
Ubuntu:20.04:LTS canonical linux-intel-5.13 All versions
Ubuntu:20.04:LTS canonical linux-oem-5.10 All versions
Ubuntu:20.04:LTS canonical linux-oem-5.13 All versions
Ubuntu:20.04:LTS canonical linux-oem-5.14 All versions
Ubuntu:20.04:LTS canonical linux-oem-5.6 All versions
Ubuntu:20.04:LTS canonical linux-oracle-5.11 All versions
Ubuntu:20.04:LTS canonical linux-oracle-5.13 All versions
Ubuntu:20.04:LTS canonical linux-oracle-5.8 All versions
Ubuntu:20.04:LTS canonical linux-raspi2 All versions
Ubuntu:20.04:LTS canonical linux-riscv All versions
Ubuntu:20.04:LTS canonical linux-riscv-5.11 All versions
Ubuntu:20.04:LTS canonical linux-riscv-5.8 All versions
Ubuntu:22.04:LTS canonical linux-allwinner-5.19 All versions
Ubuntu:22.04:LTS canonical linux-aws-5.19 All versions
Ubuntu:22.04:LTS canonical linux-aws-6.2 All versions
Showing 50 of 162. Show the rest
Ecosystem VendorProductAffected versions
Ubuntu:22.04:LTS canonical linux-aws-6.5 All versions
Ubuntu:22.04:LTS canonical linux-aws-6.8 All versions
Ubuntu:22.04:LTS canonical linux-azure-5.19 All versions
Ubuntu:22.04:LTS canonical linux-azure-6.2 All versions
Ubuntu:22.04:LTS canonical linux-azure-6.5 All versions
Ubuntu:22.04:LTS canonical linux-azure-6.8 All versions
Ubuntu:22.04:LTS canonical linux-azure-fde-5.19 All versions
Ubuntu:22.04:LTS canonical linux-azure-fde-6.2 All versions
Ubuntu:22.04:LTS canonical linux-azure-fde-6.8 All versions
Ubuntu:22.04:LTS canonical linux-gcp-5.19 All versions
Ubuntu:22.04:LTS canonical linux-gcp-6.2 All versions
Ubuntu:22.04:LTS canonical linux-gcp-6.5 All versions
Ubuntu:22.04:LTS canonical linux-gcp-6.8 All versions
Ubuntu:22.04:LTS canonical linux-hwe-5.19 All versions
Ubuntu:22.04:LTS canonical linux-hwe-6.2 All versions
Ubuntu:22.04:LTS canonical linux-hwe-6.5 All versions
Ubuntu:22.04:LTS canonical linux-hwe-6.8 All versions
Ubuntu:22.04:LTS canonical linux-ibm-6.8 All versions
Ubuntu:22.04:LTS canonical linux-intel-iot-realtime All versions
Ubuntu:22.04:LTS canonical linux-lowlatency-hwe-5.19 All versions
Ubuntu:22.04:LTS canonical linux-lowlatency-hwe-6.2 All versions
Ubuntu:22.04:LTS canonical linux-lowlatency-hwe-6.5 All versions
Ubuntu:22.04:LTS canonical linux-lowlatency-hwe-6.8 All versions
Ubuntu:22.04:LTS canonical linux-nvidia-6.2 All versions
Ubuntu:22.04:LTS canonical linux-nvidia-6.5 All versions
Ubuntu:22.04:LTS canonical linux-nvidia-6.8 All versions
Ubuntu:22.04:LTS canonical linux-oem-5.17 All versions
Ubuntu:22.04:LTS canonical linux-oem-6.0 All versions
Ubuntu:22.04:LTS canonical linux-oem-6.1 All versions
Ubuntu:22.04:LTS canonical linux-oem-6.5 All versions
Ubuntu:22.04:LTS canonical linux-oracle-6.5 All versions
Ubuntu:22.04:LTS canonical linux-oracle-6.8 All versions
Ubuntu:22.04:LTS canonical linux-realtime All versions
Ubuntu:22.04:LTS canonical linux-riscv-5.19 All versions
Ubuntu:22.04:LTS canonical linux-riscv-6.5 All versions
Ubuntu:22.04:LTS canonical linux-riscv-6.8 All versions
Ubuntu:22.04:LTS canonical linux-starfive-5.19 All versions
Ubuntu:22.04:LTS canonical linux-starfive-6.2 All versions
Ubuntu:22.04:LTS canonical linux-starfive-6.5 All versions
Ubuntu:Pro:Realtime:22.04:LTS canonical linux-realtime-6.8 All versions
Ubuntu:24.04:LTS canonical linux All versions
Ubuntu:24.04:LTS canonical linux-aws All versions
Ubuntu:24.04:LTS canonical linux-aws-6.14 All versions
Ubuntu:24.04:LTS canonical linux-aws-6.17 All versions
Ubuntu:24.04:LTS canonical linux-azure-6.11 All versions
Ubuntu:24.04:LTS canonical linux-azure-6.14 All versions
Ubuntu:24.04:LTS canonical linux-azure-6.17 All versions
Ubuntu:24.04:LTS canonical linux-azure-7.0 < 7.0.0-1014.14~24.04.1
Fix: upgrade to 7.0.0-1014.14~24.04.1
Ubuntu:24.04:LTS canonical linux-azure-fde-6.14 All versions
Ubuntu:24.04:LTS canonical linux-azure-fde-6.17 All versions
Ubuntu:24.04:LTS canonical linux-azure-nvidia All versions
Ubuntu:24.04:LTS canonical linux-azure-nvidia-6.14 All versions
Ubuntu:24.04:LTS canonical linux-gcp-6.11 All versions
Ubuntu:24.04:LTS canonical linux-gcp-6.14 All versions
Ubuntu:24.04:LTS canonical linux-gcp-6.17 All versions
Ubuntu:24.04:LTS canonical linux-gcp-7.0 < 7.0.0-1011.11~24.04.1
Fix: upgrade to 7.0.0-1011.11~24.04.1
Ubuntu:24.04:LTS canonical linux-hwe-6.11 All versions
Ubuntu:24.04:LTS canonical linux-hwe-6.14 All versions
Ubuntu:24.04:LTS canonical linux-hwe-6.17 All versions
Ubuntu:24.04:LTS canonical linux-hwe-7.0 < 7.0.0-28.28~24.04.1
Fix: upgrade to 7.0.0-28.28~24.04.1
Ubuntu:24.04:LTS canonical linux-ibm All versions
Ubuntu:24.04:LTS canonical linux-lowlatency All versions
Ubuntu:24.04:LTS canonical linux-lowlatency-hwe-6.11 All versions
Ubuntu:24.04:LTS canonical linux-nvidia All versions
Ubuntu:24.04:LTS canonical linux-nvidia-6.11 All versions
Ubuntu:24.04:LTS canonical linux-nvidia-6.17 All versions
Ubuntu:24.04:LTS canonical linux-nvidia-7.0 < 7.0.0-1016.16~24.04.1
Fix: upgrade to 7.0.0-1016.16~24.04.1
Ubuntu:24.04:LTS canonical linux-nvidia-lowlatency All versions
Ubuntu:24.04:LTS canonical linux-nvidia-tegra < 6.8.0-1035.38
Fix: upgrade to 6.8.0-1035.38
Ubuntu:24.04:LTS canonical linux-oem-6.11 All versions
Ubuntu:24.04:LTS canonical linux-oem-6.14 All versions
Ubuntu:24.04:LTS canonical linux-oem-6.17 All versions
Ubuntu:24.04:LTS canonical linux-oem-6.8 All versions
Ubuntu:24.04:LTS canonical linux-oracle All versions
Ubuntu:24.04:LTS canonical linux-oracle-6.14 All versions
Ubuntu:24.04:LTS canonical linux-oracle-6.17 All versions
Ubuntu:24.04:LTS canonical linux-oracle-7.0 < 7.0.0-1011.11~24.04.1
Fix: upgrade to 7.0.0-1011.11~24.04.1
Ubuntu:24.04:LTS canonical linux-raspi All versions
Ubuntu:24.04:LTS canonical linux-raspi-realtime All versions
Ubuntu:24.04:LTS canonical linux-riscv-6.14 All versions
Ubuntu:24.04:LTS canonical linux-riscv-6.17 All versions
Ubuntu:24.04:LTS canonical linux-riscv-7.0 < 7.0.0-28.28.1~24.04.3
Fix: upgrade to 7.0.0-28.28.1~24.04.3
Ubuntu:24.04:LTS canonical linux-xilinx All versions
Ubuntu:Nvidia-BlueField:24.04:LTS canonical linux-bluefield All versions
Ubuntu:Pro:FIPS-updates:24.04:LTS canonical linux-aws-fips All versions
Ubuntu:Pro:FIPS-updates:24.04:LTS canonical linux-azure-fips All versions
Ubuntu:Pro:FIPS-updates:24.04:LTS canonical linux-fips All versions
Ubuntu:Pro:FIPS-updates:24.04:LTS canonical linux-gcp-fips All versions
Ubuntu:Pro:Realtime:24.04:LTS canonical linux-realtime-6.14 All versions
Ubuntu:Pro:Realtime:24.04:LTS canonical linux-realtime-6.17 All versions
Ubuntu:26.04:LTS canonical linux < 7.0.0-28.28
Fix: upgrade to 7.0.0-28.28
Ubuntu:26.04:LTS canonical linux-aws < 7.0.0-1009.9
Fix: upgrade to 7.0.0-1009.9
Ubuntu:26.04:LTS canonical linux-azure < 7.0.0-1010.10
Fix: upgrade to 7.0.0-1010.10
Ubuntu:26.04:LTS canonical linux-azure-fde < 7.0.0-1009.9
Fix: upgrade to 7.0.0-1009.9
Ubuntu:26.04:LTS canonical linux-gcp < 7.0.0-1008.8
Fix: upgrade to 7.0.0-1008.8
Ubuntu:26.04:LTS canonical linux-gke < 7.0.0-1003.4
Fix: upgrade to 7.0.0-1003.4
Ubuntu:26.04:LTS canonical linux-ibm < 7.0.0-1010.10
Fix: upgrade to 7.0.0-1010.10
Ubuntu:26.04:LTS canonical linux-nvidia < 7.0.0-1016.16
Fix: upgrade to 7.0.0-1016.16
Ubuntu:26.04:LTS canonical linux-nvidia-bos < 7.0.0-2016.16
Fix: upgrade to 7.0.0-2016.16
Ubuntu:26.04:LTS canonical linux-oem-7.0 < 7.0.0-1009.9
Fix: upgrade to 7.0.0-1009.9
Ubuntu:26.04:LTS canonical linux-oracle < 7.0.0-1008.8
Fix: upgrade to 7.0.0-1008.8
Ubuntu:26.04:LTS canonical linux-raspi < 7.0.0-1015.15
Fix: upgrade to 7.0.0-1015.15
Ubuntu:26.04:LTS canonical linux-realtime < 7.0.0-28.28.1
Fix: upgrade to 7.0.0-28.28.1
Ubuntu:26.04:LTS canonical linux-riscv < 7.0.0-28.28.1
Fix: upgrade to 7.0.0-28.28.1
Debian:13 debian linux All versions
Debian:14 debian linux < 7.0.12-1
Fix: upgrade to 7.0.12-1
Ubuntu:24.04:LTS canonical linux-azure-fde-7.0 All versions
Root:Debian:13 – linux < 6.12.113-1.aikido.163
Fix: upgrade to 6.12.113-1.aikido.163
Root:Debian:13 – rootio-linux < 6.12.113-1.aikido.163
Fix: upgrade to 6.12.113-1.aikido.163
Ubuntu:24.04:LTS canonical linux-vmware All versions
Alpaquita:25 bellsoft linux-lts >= 6.12.112-r0, < 6.12.115-r0
Fix: upgrade to 6.12.115-r0
Alpaquita:stream bellsoft linux-lts >= 6.18.43-r0, < 6.18.46-r0
Fix: upgrade to 6.18.46-r0
Original advisory text
BELL-CVE-2026-63979
In the Linux kernel, the following vulnerability has been resolved:

net/handshake: hand off the pinned file reference to accept_doit

handshake_req_next() removes the request from the per-net
pending list and drops hn_lock before handshake_nl_accept_doit()
reads req->hr_sk->sk_socket and dereferences sock->file (once in
FD_PREPARE() and again in get_file()). In that window a
consumer running tls_handshake_cancel() followed by sockfd_put()
(svc_sock_free) or __fput_sync() (xs_reset_transport) releases
sock->file. sock_release() then runs sock_orphan(), zeroing
sk_socket, and frees the struct socket. The accept-side code
either reads NULL through sk_socket or chases freed memory.

The submit-side sock_hold() does not prevent this. sk_refcnt
protects struct sock, but struct socket and sock->file are
independently refcounted via the file descriptor the consumer
owns. Pinning sk leaves sock and sock->file unprotected.

Retarget the accept-side dereferences at req->hr_file, which was
pinned at submit time, instead of req->hr_sk->sk_socket->file.
Pinning on its own is not sufficient: a consumer that cancels
between handshake_req_next() returning and accept_doit reaching
FD_PREPARE() takes the !remove_pending() branch in
handshake_req_cancel() and drops hr_file before the accept side
takes its own reference. Hand off an additional file reference
inside handshake_req_next(), under hn_lock, so the accept side
operates on a reference that no concurrent handshake_req_cancel()
can revoke. FD_PREPARE() consumes that handed-off reference,
either by transferring it to the new fd in fd_publish() or by
dropping it in the cleanup destructor on error; the explicit
get_file() that previously balanced FD_PREPARE() is therefore
redundant and goes away.

Update handshake_req_cancel_test2 and _test3 to simulate the
FD_PREPARE() consumption with an fput() so the kunit file-count
assertions stay balanced.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-416Use After Free
Timeline
Published22 Jul 2026
Updated4 Nov 2026
First seen19 Jul 2026
Sources
ROOT-OS-DEBIAN-13-CVE-2026-63979 · OSV
CVE-2026-63979 · NVD
CVE-2026-63979 · MITRE
CVE-2026-63979 · OSV
DEBIAN-CVE-2026-63979 · OSV
UBUNTU-CVE-2026-63979 · OSV
BELL-CVE-2026-63979 · OSV
Track software like this
Free during beta