In the Linux kernel, the following vulnerability has been resolved: net/handshake: hand off the pinned file reference to accept_doit… (CVE-2026-63979)
A critical vulnerability in the Linux kernel involving improper handling of pinned file references during network handshake operations has been resolved. The flaw allowed a race condition where the accept-side code could dereference a NULL or freed socket file pointer, potentially leading to memory corruption. The fix involves handing off an additional file reference under lock to ensure safe access during the accept operation.
AI Analysis
Technical Summary
The vulnerability (CVE-2026-63979) in the Linux kernel's net/handshake code arises from a race condition between the accept-side code and a consumer canceling a handshake request. The accept-side dereferences sock->file via req->hr_sk->sk_socket, but the consumer can release sock->file concurrently, causing use-after-free or NULL pointer dereference. The patch changes the accept-side to use a pinned file reference (req->hr_file) handed off under lock, ensuring the accept code operates on a valid reference that cannot be revoked concurrently. This eliminates the unsafe dereference and balances file reference counts properly.
Potential Impact
Exploitation of this vulnerability could lead to a denial of service or potentially arbitrary code execution due to use-after-free or NULL pointer dereference in kernel space. The CVSS score of 9.8 indicates critical impact with network attack vector, no privileges required, and full confidentiality, integrity, and availability impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The description indicates the vulnerability has been resolved in the Linux kernel source code. Users should monitor official Linux kernel advisories and update to a fixed kernel version once available. No specific workaround or temporary fix is described.
In the Linux kernel, the following vulnerability has been resolved: net/handshake: hand off the pinned file reference to accept_doit… (CVE-2026-63979)
Description
A critical vulnerability in the Linux kernel involving improper handling of pinned file references during network handshake operations has been resolved. The flaw allowed a race condition where the accept-side code could dereference a NULL or freed socket file pointer, potentially leading to memory corruption. The fix involves handing off an additional file reference under lock to ensure safe access during the accept operation.
CVSS v3.1
Score 9.8critical
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability (CVE-2026-63979) in the Linux kernel's net/handshake code arises from a race condition between the accept-side code and a consumer canceling a handshake request. The accept-side dereferences sock->file via req->hr_sk->sk_socket, but the consumer can release sock->file concurrently, causing use-after-free or NULL pointer dereference. The patch changes the accept-side to use a pinned file reference (req->hr_file) handed off under lock, ensuring the accept code operates on a valid reference that cannot be revoked concurrently. This eliminates the unsafe dereference and balances file reference counts properly.
Potential Impact
Exploitation of this vulnerability could lead to a denial of service or potentially arbitrary code execution due to use-after-free or NULL pointer dereference in kernel space. The CVSS score of 9.8 indicates critical impact with network attack vector, no privileges required, and full confidentiality, integrity, and availability impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The description indicates the vulnerability has been resolved in the Linux kernel source code. Users should monitor official Linux kernel advisories and update to a fixed kernel version once available. No specific workaround or temporary fix is described.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-52c3-j5qj-8hpp
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-63979"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- 3.1
Threat ID: 6a5d27aa2a4a8d598912e263
Added to database: 07/19/2026, 19:38:18 UTC
Last enriched: 08/10/2026, 20:41:23 UTC
Last updated: 08/29/2026, 10:52:10 UTC
Views: 116
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.