CVE-2025-68775
- Source
- https://cve.org/CVERecord?id=CVE-2025-68775
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-68775.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2025-68775
- Downstream
- Related
- Published
- 2026-01-13T15:28:52.069Z
- Modified
- 2026-01-30T01:26:04.190314Z
- Summary
- net/handshake: duplicate handshake cancellations leak socket
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
net/handshake: duplicate handshake cancellations leak socket
When a handshake request is cancelled it is removed from the handshakenet->hnrequests list, but it is still present in the handshake_rhashtbl until it is destroyed.
If a second cancellation request arrives for the same handshake request, then removepending() will return false... and assuming HANDSHAKEFREQCOMPLETED isn't set in req->hrflags, we'll continue processing through the outtrue label, where we put another reference on the sock and a refcount underflow occurs.
This can happen for example if a handshake times out - particularly if the SUNRPC client sends the AUTHTLS probe to the server but doesn't follow it up with the ClientHello due to a problem with tlshd. When the timeout is hit on the server, the server will send a FIN, which triggers a cancellation request via xsresettransport(). When the timeout is hit on the client, another cancellation request happens via xstlshandshakesync().
Add a testandsetbit(HANDSHAKEFREQCOMPLETED) in the pending cancel path so duplicate cancels can be detected.
- Database specific
{ "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68775.json", "cna_assigner": "Linux" }- References
-
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- https://git.kernel.org/stable/c/011ae80c49d9bfa5b4336f8bd387cd25c7593663
- https://git.kernel.org/stable/c/15564bd67e2975002f2a8e9defee33e321d3183f
- https://git.kernel.org/stable/c/3c330f1dee3cd92b57e19b9d21dc8ce5970b09be
- https://git.kernel.org/stable/c/e1641177e7fb48a0a5a06658d4aab51da6656659
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/68xxx/CVE-2025-68775.json
- https://nvd.nist.gov/vuln/detail/CVE-2025-68775
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced3b3009ea8abb713b022d94fba95ec270cf6e7eaeFixed011ae80c49d9bfa5b4336f8bd387cd25c7593663Fixede1641177e7fb48a0a5a06658d4aab51da6656659Fixed3c330f1dee3cd92b57e19b9d21dc8ce5970b09beFixed15564bd67e2975002f2a8e9defee33e321d3183f