External risk intelligence

Linux Kernel Duplicate Handshake Cancellation Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-68775

The vulnerability involves the Linux kernel's SUNRPC TLS handshake mechanism. While network-exposed due to its role in RPC communication, the flaw requires specific, race-condition-inducing conditions—duplicate cancellation requests—making it less likely to be triggered by standard remote network traffic than a direct service exploit.

Halo Surface Signal: 3 out of 5 — possibly public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a vulnerability in the Linux kernel's network handshake process. The issue stems from how duplicate cancellation requests are handled, potentially leading to resource leaks and system instability. While the vulnerability is rated critical, its exploitation requires specific timing and conditions, making direct, widespread exploitation less likely without further context on affected services and configurations.

Duplicate handshake cancellations can cause issues.
Matters due to potential system instability.
Confirm relevance and exposure for your systems.

Attack Path

How an attacker could exploit the issue

An attacker can reach this vulnerability by sending duplicate cancellation requests to a handshake process, such as when a handshake times out. This occurs due to how the Linux kernel manages handshake requests during cancellations, where a request is removed from one list but not another. This can lead to a reference count underflow, potentially allowing for further compromise.

Requires network access.
Triggered by duplicate handshake cancellations.
Can lead to a refcount underflow.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could affect the behavior of network services using TLS handshakes. When duplicate cancellation requests occur for a handshake, it can lead to a reference count underflow on socket resources. This condition might be triggered by timeouts during the SUNRPC client's AUTH_TLS probe to the server, especially if the ClientHello message is not subsequently sent due to issues with `tlshd`.

Kernel socket resources could be affected.
Duplicate handshake cancellations may occur.
Service instability or crashes could result.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides within the Linux kernel's networking subsystem, specifically affecting handshake cancellations. Ownership likely falls to the platform or infrastructure teams managing the kernel, with potential coordination needed from network and security teams to assess exposure. The initial practical move is to identify all systems running the affected kernel, confirm if they are exposed to the internet or sensitive internal networks, and then prioritize remediation based on their criticality and exposure.

Platform teams own the issue.
Verify affected kernel instances.
Plan risk-based remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel network handshake component?

The Linux kernel includes a networking subsystem that manages how connections are established securely. The handshake mechanism specifically supports protocols like SUNRPC, which uses TLS to encrypt communication between clients and servers. This component ensures that connection attempts are tracked and finalized correctly, playing a vital role in maintaining stable, encrypted network services across various infrastructure environments.

How does CVE-2025-68775 affect memory management?

This vulnerability is a resource management error. When the kernel processes a handshake cancellation, it fails to fully clean up the request in all internal tracking lists. If a second, duplicate cancellation request is sent for the same handshake, the kernel incorrectly attempts to release the socket a second time. This logic error leads to a reference count underflow, which can destabilize the kernel's tracking of active socket resources.

Do I need a special trigger to cause this vulnerability?

Yes. This flaw is not triggered by standard, single-request network traffic. It requires a specific race condition where multiple, duplicate cancellation requests are sent for the same handshake, typically during a timeout event. If a handshake completes successfully or only receives a single, valid cancellation, the problematic code path that leads to the underflow is not triggered.

Is this vulnerability a risk for my internet-facing systems?

Halo Surface Signal notes this is a potential risk because the handshake mechanism involves network-exposed services like SUNRPC. However, because it requires precise, duplicate timing conditions rather than simple, direct exploitation, the practical risk for internet-facing assets is lower than for more common service-level exploits. You should focus on assets that handle critical or sensitive RPC communications.

What are the first steps to address this CVE?

Begin by inventorying your infrastructure to identify which systems are running a kernel version containing the affected network handshake code. Coordinate with your platform or infrastructure teams to review the available patches from your distribution provider. Since this requires a kernel-level change, prioritize remediation on systems that are critical to your environment or handle sensitive internal traffic.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.