In the Linux kernel, the following vulnerability has been resolved: net/handshake: Take a long-lived file reference at submit handshake_nl_accept_doit() needs the file pointer backing req->hr_sk->sk_socket to survive the window between handshake_req_next() and the subsequent FD_PREPARE() and get_file(). The submit-side sock_hold() does not provide that. sk_refcnt keeps struct sock alive, but struct socket is owned by sock->file: when the consumer fputs the last file reference, sock_release() tears the socket down regardless of any sock_hold. Add an hr_file pointer to struct handshake_req and acquire an explicit reference on sock->file during handshake_req_submit(). handshake_complete() and handshake_req_cancel() release the reference on the completion-bit-winning path. The submit error path must also release the file reference, but after rhashtable insertion a concurrent handshake_req_cancel() can discover the request and race the error path. Gate the error-path cleanup -- sk_destruct restoration, fput, and request destruction -- with test_and_set_bit(HANDSHAKE_F_REQ_COMPLETED), the same serialization handshake_complete() and handshake_req_cancel() already use. When cancel has already claimed ownership, the submit error path returns without touching the request; socket teardown handles final destruction. The accept-side dereferences are not yet retargeted; that change comes in the next patch.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - net/handshake: Take a long-lived file reference at submit handshake_nl_accept_doit() needs the file     pointer backing req->hr_sk->sk_socket to survive the window between handshake_req_next() and the     subsequent FD_PREPARE() and get_file(). The submit-side sock_hold() does not provide that. sk_refcnt keeps     struct sock alive, but struct socket is owned by sock->file: when the consumer fputs the last file     reference, sock_release() tears the socket down regardless of any sock_hold. Add an hr_file pointer to     struct handshake_req and acquire an explicit reference on sock->file during handshake_req_submit().
    handshake_complete() and handshake_req_cancel() release the reference on the completion-bit-winning path.
    The submit error path must also release the file reference, but after rhashtable insertion a concurrent     handshake_req_cancel() can discover the request and race the error path. Gate the error-path cleanup --     sk_destruct restoration, fput, and request destruction -- with     test_and_set_bit(HANDSHAKE_F_REQ_COMPLETED), the same serialization handshake_complete() and     handshake_req_cancel() already use. When cancel has already claimed ownership, the submit error path     returns without touching the request; socket teardown handles final destruction. The accept-side     dereferences are not yet retargeted; that change comes in the next patch. (CVE-2026-64523)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
343049	Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500248)	Nessus	Oracle Linux Local Security Checks	Local	high
341888	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-2106)	Nessus	Amazon Linux Local Security Checks	Local	high
340681	Ubuntu 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : Linux kernel (NVIDIA) vulnerabilities (USN-8663-1)	Nessus	Ubuntu Local Security Checks	Local	high
340045	Ubuntu 26.04 LTS : Linux kernel (NVIDIA BaseOS) vulnerabilities (USN-8664-1)	Nessus	Ubuntu Local Security Checks	Local	high
333762	Photon OS 5.0: Linux PHSA-2026-5.0-92-0895	Nessus	PhotonOS Local Security Checks	Local	high
329830	Linux Distros Unpatched Vulnerability : CVE-2026-64523	Nessus	Misc.	Local	critical
328493	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1968)	Nessus	Amazon Linux Local Security Checks	Local	high
322944	Photon OS 5.0: Linux PHSA-2026-5.0-0895	Nessus	PhotonOS Local Security Checks	Local	high

Detections

Analytics

CVE-2026-64523

critical

Tenable Plugins

high

high

high

high

high

critical

high

high