CVE-2026-64523 addresses a vulnerability in the Linux kernel's net/handshake code where the handshake_nl_accept_doit() function requires a long-lived file pointer for the socket backing req->hr_sk->sk_socket. The existing sock_hold() call only maintains the struct sock, but the struct socket is owned by sock->file, which can be released prematurely causing socket teardown. The patch adds an explicit hr_file pointer to struct handshake_req and acquires a reference on sock->file during handshake_req_submit(), releasing it appropriately on completion or cancellation. The error path cleanup is gated to avoid races with concurrent cancellation. This fix ensures the socket remains valid throughout the handshake request lifecycle.

The vulnerability could cause premature teardown of socket structures during handshake request processing, potentially leading to denial of service or other critical impacts on network communication. The CVSS score of 9.8 indicates high impact on confidentiality, integrity, and availability if exploited.

A fix has been implemented in the Linux kernel to properly manage file references during handshake request submission, preventing premature socket teardown. Users should apply the official kernel patch that includes this fix. No additional mitigations are indicated.