CVE-2025-68775
A critical flaw in the Linux kernel’s handshake handling can cause a reference count underflow and potentially crash the system. The bug occurs when duplicate handshake cancellations are processed, leading to a socket leak and kernel panic. The issue has been fixed in a kernel update.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel (all versions before the fix) on systems that use the handshake mechanism, such as Sun RPC clients and servers.
Real-world impact
An attacker could trigger a kernel crash or denial of service by sending crafted handshake cancellation requests, potentially causing the system to become unresponsive.
Why this severity
The CVSS score of 9.8 reflects the high impact of a kernel crash (availability), the lack of authentication or user interaction needed, and the fact that the flaw is exploitable over the network.
What to do about it
- 01Upgrade the Linux kernel to a version that includes the fix for CVE-2025-68775.
- 02Reboot the system to load the new kernel.
NVD-referenced vendor advisory
Timeline
- Jan 13, 2026 · Jan 13, 2026PublishedDisclosed and added to the National Vulnerability Database.
- Jul 30, 2026 · 6d agoAdvisory updatedThe NVD record was last revised.
- Jul 30, 2026 · 6d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.