Linux kernel sunrpc: TLS handshake cancel race re-enters the handshake and corrupts the completion queue

Impact

When the server-side TLS handshake wait in svc_tcp_handshake() times out or is interrupted and tls_handshake_cancel() then loses the race, the code inspects xpt_flags before the completion callback has committed its side effects. One ordering lets the dispatcher see XPT_HANDSHAKE still set and invoke xpo_handshake a second time, so init_completion() runs on sk_handshake_done while the first callback is calling complete_all() on it - the embedded swait_queue is corrupted. The other ordering tears down a connection that was about to succeed. This is on the RPC-with-TLS server path, i.e. NFS servers exporting datasets to GPU nodes with xprtsec enabled; signal delivery alone is enough to enter the window, so it is not a rare timing fluke. Expect kernel-side instability on the file server rather than a clean failure.

Who can reach it

Reachable on any RPC server with TLS enabled whenever a connection close or a signal overlaps the tlshd downcall window. An unauthenticated client that can open and drop TLS connections to the server influences the timing; no credentials are needed to reach the handshake path.

What to do

Apply the stable-kernel fix, which waits for the callback to commit before inspecting xpt_flags. Kernel update plus reboot on each NFS/RPC server; failover first if clustered. Disabling xprtsec/TLS on the server removes the path entirely but gives up on-the-wire encryption. No vendor advisory beyond the kernel stable commits is present in the record.

References

Related entries

• Linux kernel sunrpc: svc_sock freed while the TLS handshake callback is still writing to itCVE-2026-72222 · Linux kernel sunrpc (svc_xprt lifetime across the asynchronous TLS handshake callback)Critical
• Linux kernel SUNRPC client: use-after-free on the upper rpc_clnt when a TLS mount handshake fails fatallyCVE-2026-72317 · Linux kernel SUNRPC client (xs_tcp_tls_setup_socket, upper rpc_clnt lifetime)Critical
• Linux kernel (net/xfrm): The IPsec input path validates a security association before taking the state lock, so a stateCVE-2026-72451 · Linux kernel (net/xfrm)Critical
• Linux kernel (net/xfrm): Async ESP resumption holds a reference on the original skbCVE-2026-72463 · Linux kernel (net/xfrm)Critical
• Linux kernel NFS client: file lock list traversed without nfsi->rwsem, allowing use-after-free on lock structuresCVE-2026-72472 · Linux kernel NFS client (file lock list traversal during delegation recall and state recovery)Critical
• Linux kernel SoftiWARP connection manager (siw_cm, endpoint/socket disassociation): A malformed MPA request duringCVE-2026-74345 · Linux kernel SoftiWARP connection manager (siw_cm, endpoint/socket disassociation)Critical