CVE-2026-64523

A flaw was found in the Linux kernel's networking handshake component. This vulnerability occurs because a critical file reference is not properly maintained during the handshake process. An attacker could potentially exploit this by causing the system to prematurely release a socket, leading to a use-after-free condition. This could result in a system crash, causing a denial of service.

This vulnerability is rated as Moderate severity for Red Hat Enterprise Linux because exploiting the race condition requires local access and precise timing during concurrent kernel network handshake requests, limiting the practical risk primarily to a localized denial of service. In typical enterprise deployments, kernel-level network handshake processing is only utilized when specific in-kernel TLS-dependent protocols are actively configured. Because unprivileged actors cannot routinely force these specific socket release states without existing access and targeted subsystem interactions, the overall blast radius remains contained.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.