In the Linux kernel, the following vulnerability has been resolved: wireguard: noise: reject response consumption after intermediate initiation Two… (CVE-2026-99059)

The vulnerability in the Linux kernel WireGuard module relates to concurrent processing of an identical response message by two threads during the Noise protocol handshake. Thread A and Thread B both process the same response, and due to timing and locking behavior, Thread B may resume after Thread C resets the handshake state, causing Thread B to reuse an outdated handshake state and derive a new session from it. The race condition arises from the interaction of read-write locks and state checks during the handshake process. The fix involves verifying the ephemeral private key on the stack against the latest handshake state to prevent reuse of stale state data.

The impact is limited to a potential race condition in the handshake process that could cause a handshake state to be reused incorrectly. The vulnerability is considered very difficult to trigger in practice, and no known exploits are reported. The issue could theoretically lead to session state confusion but does not have documented direct exploitation consequences.

A fix has been implemented in the Linux kernel WireGuard code to prevent this race condition by comparing the ephemeral private key with the latest handshake state. Users should update to the fixed kernel version once available. No additional mitigation actions are indicated as the issue is unlikely to be exploitable in practice.