CVE-2025-68775: 
Linux Kernel vulnerability analysis and mitigation

CVE-2025-68775 is a socket resource leak vulnerability in the Linux kernel's net/handshake subsystem caused by duplicate handshake cancellations. When a handshake request is cancelled, it is removed from the handshake_net->hn_requests list but remains in the handshake_rhashtbl until destroyed; a second cancellation triggers a reference count underflow on the socket, leading to a socket leak. The vulnerability was published on January 13, 2026, and affects Linux kernel versions starting from commit 3b3009ea8abb713b022d94fba95ec270cf6e7eae up to the patched releases. It carries a CVSS v3.1 base score of 6.5 (Medium), requiring low privileges and no user interaction over a network vector (Red Hat CVE, Feedly).

The root cause is a race condition / improper state management (related to CWE-911: Improper Update of Reference Count) in the Linux kernel's TLS handshake cancellation logic. When remove_pending() returns false for a second cancellation of the same handshake request, and the HANDSHAKE_F_REQ_COMPLETED flag is not set in req->hr_flags, execution falls through to the out_true label, where an additional reference is placed on the socket, causing a refcount underflow. A concrete trigger scenario involves SUNRPC TLS: the client sends an AUTH_TLS probe but fails to follow up with a ClientHello (e.g., due to a tlshd problem); the server timeout causes a FIN and triggers xs_reset_transport(), while the client timeout independently triggers xs_tls_handshake_sync(), resulting in two concurrent cancellation requests for the same handshake object. The fix adds a test_and_set_bit(HANDSHAKE_F_REQ_COMPLETED) check in the pending cancel path to atomically detect and block duplicate processing (kernel.org patches).

Successful exploitation results in socket resource exhaustion (denial of service) on the affected Linux system, with no confidentiality or integrity impact. The refcount underflow causes sockets to be leaked rather than properly freed, which over time can exhaust kernel socket resources and degrade or halt network services on the host. Systems using SUNRPC over TLS (e.g., NFS with TLS) are particularly susceptible, and the impact is limited to availability of the affected host rather than enabling lateral movement or data exfiltration (Red Hat CVE, Feedly).

• Logs: Kernel logs (dmesg / journalctl -k) showing refcount underflow warnings or use-after-free messages related to socket objects in the net/handshake subsystem; repeated SUNRPC TLS timeout errors.
• Network: Unusual accumulation of half-open or leaked TLS handshake connections on NFS/SUNRPC ports (typically TCP 2049); AUTH_TLS probes without corresponding ClientHello completions visible in packet captures.
• System Metrics: Gradual exhaustion of kernel socket descriptors (ss -s showing increasing socket counts without corresponding application growth); elevated memory usage in kernel slab allocator for socket-related objects (/proc/slabinfo).

Patches have been released for the following Linux kernel stable versions: 6.6.120, 6.12.64, 6.18.3, and 6.19-rc2, via commits 011ae80c49d9bfa5b4336f8bd387cd25c7593663, 15564bd67e2975002f2a8e9defee33e321d3183f, 3c330f1dee3cd92b57e19b9d21dc8ce5970b09be, and e1641177e7fb48a0a5a06658d4aab51da6656659 respectively (kernel.org patches). Microsoft has released an update for azl3_kernel_6.6.119.3-3, and Ubuntu has issued multiple security notices (USN-8177-1, USN-8179-1/2/3/4, USN-8183-1/2, USN-8184-1, USN-8185-1/2, USN-8203-1, USN-8245-1, USN-8257-1, USN-8258-1, USN-8260-1, USN-8265-1) (Ubuntu Security). As a workaround for systems that cannot be immediately patched, administrators should consider disabling SUNRPC over TLS (NFS with TLS) if not required, and implement network segmentation to limit exposure of vulnerable kernel services.

Red Hat has acknowledged the vulnerability and published a CVE advisory page, rating it as Medium severity (Red Hat CVE). Ubuntu, SUSE, Oracle Linux, Dell, and Google Cloud have all issued advisories or release notes referencing this CVE, indicating broad distribution-level awareness and patching activity. No notable independent researcher commentary or significant social media discussion has been identified for this vulnerability.