cve 2026 64523

CVE-2026-64523 is a Linux kernel lifetime bug in the net/handshake subsystem that can leave TLS-handshake code holding a socket file pointer after the owning consumer has released it. The Linux kernel CVE team lists fixed releases as Linux 6.12.93, Linux 7.0.12, and Linux 7.1; administrators running older kernels should take a supported kernel update rather than attempt to apply the named change by itself. The defect is not in Windows, Windows networking, or the ordinary TLS stacks used by browsers and applications. It affects Linux systems that have the kernel's generic-netlink TLS handshake service built and that actually use an in-kernel consumer of that service.