CVE-2024-26831

What it actually does

Replacement of synchronous sock_release(sock) with asynchronous fput(filp) in the Linux kernel handshake code delays invocation of the ->hp_destroy callback, so handshake_req_cancel() followed by file close no longer guarantees immediate destruction and the subsequent pointer-equality test fails.

Why it matters to the business

Kernel developers and distributions experience broken selftests and possible delayed cleanup of handshake requests on affected stable trees, increasing validation effort and introducing a narrow window for resource-leak or use-after-free conditions during network handshake teardown.

How an attack unfolds

An attacker would craft a sequence of handshake requests, issue cancel operations, and close the associated file descriptor while racing the delayed fput workqueue; the delay could be leveraged to observe or manipulate kernel structures before ->hp_destroy runs, though public exploit maturity remains none and listed threat actors focus on separate privilege-escalation CVEs.

How to fix it

Apply the upstream fix commit d74226e03df1bf19848f18344401f254345af912 (or the corresponding stable backport) to restore synchronous destruction semantics for the test case and eliminate the timing gap.

How to confirm the fix worked

Rebuild the kernel with the fixed commit, execute the handshake_req_destroy_test1 selftest and confirm the pointer equality now passes; additionally verify that fput work is completed before the hp_destroy check in the test harness.

Typical attack path

1. Create a handshake request socket
2. Invoke handshake_req_cancel()
3. Close the file descriptor triggering fput instead of sock_release
4. Race the delayed workqueue to access stale handshake state before ->hp_destroy executes

How to detect it

Review kernel selftest logs for repeated handshake_req_destroy_test failures; inspect fput workqueue activity and handshake request structures in crash dumps or live tracing for delayed ->hp_destroy callbacks.

What your security team should do

• Prioritize kernel upgrade to the listed fixed commit on all production systems within the next patch cycle
• Include the handshake selftest in continuous integration to catch future timing regressions
• Monitor vendor advisories for backported fixes in distribution kernels