Description

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: wait for in-flight client TLS handshake callback xs_tls_handshake_sync() gives xs_tls_handshake_done() a reference to the lower transport before submitting the handshake request. On timeout or signal, the synchronous waiter drops that reference after calling tls_handshake_cancel(). handshake_req_cancel() returns false when handshake_complete() has already marked the request complete. In that case the completion callback can still be running, so dropping the callback-owned reference in the waiter can free the lower transport before xs_tls_handshake_done() stores xprt_err or drops its own reference. If cancellation loses to completion, wait until xs_tls_handshake_done() signals handshake_done and let the callback release its reference. This mirrors the server-side handshake lifetime handling and keeps the timeout or signal return value unchanged.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T20:19:36.613Z",
  "pubdate": "2026-09-11T20:19:36.613Z",
  "executiveSummary": "This vulnerability involves a race condition in the Linux kernel's SUNRPC TLS implementation, specifically within the handshake synchronization logic.\nThe flaw stems from improper reference counting during the cancellation of a TLS handshake, leading to a potential use-after-free (UAF) condition of the lower transport structure.\nThe vulnerability affects the SUNRPC client-side TLS handshake mechanism.\nAn attacker capable of triggering a race between a handshake timeout/signal and the completion callback could potentially induce memory corruption or a kernel panic.\nThe risk is significant as it involves kernel-mode memory management errors, which can lead to system instability or be leveraged for local privilege escalation.\nExploitation requires the ability to initiate RPC traffic and trigger specific timing conditions that force the handshake cancellation logic to compete with the completion callback.",
  "technicalDetails": "The vulnerability resides in the interaction between xs_tls_handshake_sync() and xs_tls_handshake_done() within the Linux kernel's RPC-over-TLS implementation.\nIn the affected flow, xs_tls_handshake_sync() initiates a TLS handshake by providing a reference to the underlying transport to xs_tls_handshake_done(). When a synchronous waiter experiences a timeout or a signal, it attempts to abort the process via tls_handshake_cancel().\nThe core issue is a race condition in handshake_req_cancel(). When this function returns false, it indicates that handshake_complete() has already marked the request as finalized. However, this does not guarantee that the completion callback has finished execution.\nIf the waiter proceeds to drop the transport reference while the callback is still executing, the callback-owned reference may be invalidated. Consequently, xs_tls_handshake_done() may attempt to access the lower transport structure after it has been freed, or attempt to drop a reference that no longer exists, resulting in a use-after-free (UAF) or double-free scenario.\nThe attack flow involves: 1) Initiating an RPC request that triggers a TLS handshake. 2) Forcing a condition (such as a signal or timeout) that causes the waiter to call cancellation routines. 3) Exploiting the narrow timing window where the completion callback is racing against the cancellation logic to access the transport pointer. If the cancellation routine incorrectly cleans up the transport reference before the callback finishes its final operations (such as storing xprt_err or releasing its own reference), the kernel accesses freed memory.\nThis behavior exposes the transport structure to memory corruption. Because this structure is critical to the stability of the RPC layer, such corruption typically results in a kernel oops, system hang, or potential arbitrary code execution if the memory is reallocated by another kernel subsystem before the callback finishes.\nThe vulnerability highlights a failure in synchronous lifetime management for asynchronous callbacks within the RPC-over-TLS stack, necessitating a modification to ensure the waiter waits for the completion callback to signal handshake_done before releasing references."
}