CVE-2026-64523

In the Linux kernel, the following vulnerability has been resolved:

net/handshake: Take a long-lived file reference at submit

handshakenlaccept_doit() needs the file pointer backing

req->hrsk->sksocket to survive the window between

handshakereqnext() and the subsequent FDPREPARE() and getfile().

The submit-side sockhold() does not provide that.  skrefcnt keeps

struct sock alive, but struct socket is owned by sock->file: when

the consumer fputs the last file reference, sock_release() tears

the socket down regardless of any sock_hold.

Add an hrfile pointer to struct handshakereq and acquire an

explicit reference on sock->file during handshakereqsubmit().

handshakecomplete() and handshakereq_cancel() release the

reference on the completion-bit-winning path.

The submit error path must also release the file reference, but

after rhashtable insertion a concurrent handshakereqcancel() can

discover the request and race the error path.  Gate the error-path

cleanup -- sk_destruct restoration, fput, and request destruction

-- with testandsetbit(HANDSHAKEFREQCOMPLETED), the same

serialization handshakecomplete() and handshakereq_cancel()

already use.  When cancel has already claimed ownership, the submit

error path returns without touching the request; socket teardown

handles final destruction.

The accept-side dereferences are not yet retargeted; that change

comes in the next patch.