CVE-2026-72222: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback

CVE-2026-72222: sunrpc: pin svc_xprt across the asynchronous TLS handshake callback

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

sunrpc: pin svc_xprt across the asynchronous TLS handshake callback

svc_tcp_handshake() stores the raw svc_xprt pointer in
tls_handshake_args.ta_data and submits the request through
tls_server_hello_x509(). The handshake core takes only
sock_hold(req->hr_sk); nothing references the embedding struct
svc_sock that svc_tcp_handshake_done() reaches via container_of().

Two close races leave the in-flight callback writing through a freed
svc_sock. svc_sock_free() calls tls_handshake_cancel() and discards
its return value: a false return means handshake_complete() has
already set HANDSHAKE_F_REQ_COMPLETED but hp_done() may not have
finished, yet svc_sock_free() proceeds to kfree(svsk). The
cancel-loser fall-through inside svc_tcp_handshake() itself produces
the same window: when wait_for_completion_interruptible_timeout()
returns <= 0 (timeout or signal) and tls_handshake_cancel() returns
false, the function does not drain, returns, and svc_handle_xprt()
calls svc_xprt_received(), which clears XPT_BUSY and can drop the
last reference. A concurrent close then runs svc_sock_free() while
svc_tcp_handshake_done() is still updating xpt_flags and walking
svsk->sk_handshake_done.

The corruption surfaces as set_bit/clear_bit RMW into the freed
xpt_flags slab slot and as complete_all() walking and writing the
freed wait_queue_head_t list embedded in sk_handshake_done -- a
slab-corruption primitive, not a benign read. The path is reachable
on any TLS-enabled NFS server whenever a connection close overlaps
the tlshd downcall delivery window; the interruptible wait means
signal delivery suffices, not just SVC_HANDSHAKE_TO expiry.

Take svc_xprt_get(xprt) immediately before tls_server_hello_x509()
so the in-flight callback owns its own reference. Release it on the
two edges where the callback is guaranteed not to fire -- submission
failure from tls_server_hello_x509() and a successful
tls_handshake_cancel() -- and at the tail of
svc_tcp_handshake_done() after complete_all().

[cel: rewrote commit message to describe the actual change]

The Linux kernel CVE team has assigned CVE-2026-72222 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.4 with commit b3cbf98e2fdf3cb147a95161560cd25987284330 and fixed in 6.6.145 with commit f3b55945dd99f29d83e1965d0141040a35262346
	Issue introduced in 6.4 with commit b3cbf98e2fdf3cb147a95161560cd25987284330 and fixed in 6.12.97 with commit 2d4f97d13fff91e0bc539216be88b884b544d49f
	Issue introduced in 6.4 with commit b3cbf98e2fdf3cb147a95161560cd25987284330 and fixed in 6.18.40 with commit 3f9ee75a97a769be258784c22b89657acb5ed9bd
	Issue introduced in 6.4 with commit b3cbf98e2fdf3cb147a95161560cd25987284330 and fixed in 7.1.5 with commit 083e9c2ec7e8bb13b79c9fd7b337abdd758ecc5f
	Issue introduced in 6.4 with commit b3cbf98e2fdf3cb147a95161560cd25987284330 and fixed in 7.2-rc1 with commit 4f988f3a2808fb659f3880c282041ff067acad78

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72222
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/sunrpc/svcsock.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/f3b55945dd99f29d83e1965d0141040a35262346
	https://git.kernel.org/stable/c/2d4f97d13fff91e0bc539216be88b884b544d49f
	https://git.kernel.org/stable/c/3f9ee75a97a769be258784c22b89657acb5ed9bd
	https://git.kernel.org/stable/c/083e9c2ec7e8bb13b79c9fd7b337abdd758ecc5f
	https://git.kernel.org/stable/c/4f988f3a2808fb659f3880c282041ff067acad78