CVE-2026-72222

In the Linux kernel, the following vulnerability has been resolved:

sunrpc: pin svc_xprt across the asynchronous TLS handshake callback

svctcphandshake() stores the raw svc_xprt pointer in

tlshandshakeargs.ta_data and submits the request through

tlsserverhello_x509(). The handshake core takes only

sockhold(req->hrsk); nothing references the embedding struct

svcsock that svctcphandshakedone() reaches via container_of().

Two close races leave the in-flight callback writing through a freed

svcsock. svcsockfree() calls tlshandshake_cancel() and discards

its return value: a false return means handshake_complete() has

already set HANDSHAKEFREQCOMPLETED but hpdone() may not have

finished, yet svcsockfree() proceeds to kfree(svsk). The

cancel-loser fall-through inside svctcphandshake() itself produces

the same window: when waitforcompletioninterruptibletimeout()

returns <= 0 (timeout or signal) and tlshandshakecancel() returns

false, the function does not drain, returns, and svchandlexprt()

calls svcxprtreceived(), which clears XPT_BUSY and can drop the

last reference. A concurrent close then runs svcsockfree() while

svctcphandshakedone() is still updating xptflags and walking

svsk->skhandshakedone.

The corruption surfaces as setbit/clearbit RMW into the freed

xptflags slab slot and as completeall() walking and writing the

freed waitqueueheadt list embedded in skhandshake_done -- a

slab-corruption primitive, not a benign read. The path is reachable

on any TLS-enabled NFS server whenever a connection close overlaps

the tlshd downcall delivery window; the interruptible wait means

signal delivery suffices, not just SVCHANDSHAKETO expiry.

Take svcxprtget(xprt) immediately before tlsserverhello_x509()

so the in-flight callback owns its own reference. Release it on the

two edges where the callback is guaranteed not to fire -- submission

failure from tlsserverhello_x509() and a successful

tlshandshakecancel() -- and at the tail of

svctcphandshakedone() after completeall().

[cel: rewrote commit message to describe the actual change]