CVE-2026-72221: sunrpc: wait for in-flight TLS handshake callback when cancel loses race

CVE-2026-72221: sunrpc: wait for in-flight TLS handshake callback when cancel loses race

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

sunrpc: wait for in-flight TLS handshake callback when cancel loses race

When wait_for_completion_interruptible_timeout() in
svc_tcp_handshake() returns 0 (timeout) or -ERESTARTSYS (signal) and
tls_handshake_cancel() then returns false, handshake_complete() has
won the cancellation race: it has set HANDSHAKE_F_REQ_COMPLETED and
is about to invoke svc_tcp_handshake_done(), but the callback's
side effects on xpt_flags and on svsk->sk_handshake_done have not
yet committed.

The current code reads xpt_flags immediately to decide whether the
session succeeded. Two races result.

If the callback has executed set_bit(XPT_TLS_SESSION) but not yet
clear_bit(XPT_HANDSHAKE), svc_tcp_handshake() sees a session,
enqueues the transport, and returns. svc_xprt_received() then
clears XPT_BUSY, a worker thread picks the transport up, the
dispatcher in svc_handle_xprt() observes XPT_HANDSHAKE still set,
and xpo_handshake is invoked a second time. That svc_tcp_handshake()
calls init_completion(&svsk->sk_handshake_done) while the original
callback concurrently calls complete_all() on it, corrupting the
embedded swait_queue.

If the callback has set HANDSHAKE_F_REQ_COMPLETED but not yet
entered svc_tcp_handshake_done(), svc_tcp_handshake() reads
XPT_TLS_SESSION as clear and tears the connection down even though
the handshake is about to succeed.

Wait for the callback to commit before inspecting xpt_flags. The
completion is guaranteed to fire because handshake_complete()
invokes svc_tcp_handshake_done() unconditionally once it has set
HANDSHAKE_F_REQ_COMPLETED.

The Linux kernel CVE team has assigned CVE-2026-72221 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.4 with commit b3cbf98e2fdf3cb147a95161560cd25987284330 and fixed in 6.6.145 with commit 0d8ceb39884148dc7a2fdf71e1cac5961ed1d2b9
	Issue introduced in 6.4 with commit b3cbf98e2fdf3cb147a95161560cd25987284330 and fixed in 6.12.97 with commit e0f4691d42a54d359d8b64509fd9ab938d4f2a33
	Issue introduced in 6.4 with commit b3cbf98e2fdf3cb147a95161560cd25987284330 and fixed in 6.18.40 with commit 65b23bec1fca6e9ebdc3e6041ebf8c6ab074141b
	Issue introduced in 6.4 with commit b3cbf98e2fdf3cb147a95161560cd25987284330 and fixed in 7.1.5 with commit a4f878e8ecd729ccf2e50993444e217583adeace
	Issue introduced in 6.4 with commit b3cbf98e2fdf3cb147a95161560cd25987284330 and fixed in 7.2-rc1 with commit d00e32f84ca1a77cb67a3fbf59f58dada95f5a21

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72221
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/sunrpc/svcsock.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/0d8ceb39884148dc7a2fdf71e1cac5961ed1d2b9
	https://git.kernel.org/stable/c/e0f4691d42a54d359d8b64509fd9ab938d4f2a33
	https://git.kernel.org/stable/c/65b23bec1fca6e9ebdc3e6041ebf8c6ab074141b
	https://git.kernel.org/stable/c/a4f878e8ecd729ccf2e50993444e217583adeace
	https://git.kernel.org/stable/c/d00e32f84ca1a77cb67a3fbf59f58dada95f5a21