---
id: CVE-2025-71148
title: 'net/handshake: restore destructor on submit failure'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  net/handshake: restore destructor on submit failure

  handshake_req_submit() replaces sk->sk_destruct but never restores it when
  submission fails before the request is h…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 3b3009ea8abb713b022d94fba95ec270cf6e7eae <
    cd8cf2be3717137554744233fda051ffc09d1d44
  - >-
    Linux >= 3b3009ea8abb713b022d94fba95ec270cf6e7eae <
    7b82a1d6ae869533d8bdb0282a3a78faed8e63dd
  - >-
    Linux >= 3b3009ea8abb713b022d94fba95ec270cf6e7eae <
    b225325be7b247c7268e65eea6090db1fc786d1f
  - >-
    Linux >= 3b3009ea8abb713b022d94fba95ec270cf6e7eae <
    6af2a01d65f89e73c1cbb9267f8880d83a88cee4
  - Linux 6.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:14:46.262541Z'
published: '2026-01-23'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:23:09.640Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2025-71148'
references:
  - url: 'https://git.kernel.org/stable/c/cd8cf2be3717137554744233fda051ffc09d1d44'
  - url: 'https://git.kernel.org/stable/c/7b82a1d6ae869533d8bdb0282a3a78faed8e63dd'
  - url: 'https://git.kernel.org/stable/c/b225325be7b247c7268e65eea6090db1fc786d1f'
  - url: 'https://git.kernel.org/stable/c/6af2a01d65f89e73c1cbb9267f8880d83a88cee4'
tags:
  - cve.org
epss: 0.00132
epssPercentile: 0.02807
ingestedAt: '2026-11-05T22:38:32.053Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

net/handshake: restore destructor on submit failure

handshake_req_submit() replaces sk->sk_destruct but never restores it when
submission fails before the request is hashed. handshake_sk_destruct() then
returns early and the original destructor never runs, leaking the socket.
Restore sk_destruct on the error path.

## Affected

- `Linux >= 3b3009ea8abb713b022d94fba95ec270cf6e7eae < cd8cf2be3717137554744233fda051ffc09d1d44`
- `Linux >= 3b3009ea8abb713b022d94fba95ec270cf6e7eae < 7b82a1d6ae869533d8bdb0282a3a78faed8e63dd`
- `Linux >= 3b3009ea8abb713b022d94fba95ec270cf6e7eae < b225325be7b247c7268e65eea6090db1fc786d1f`
- `Linux >= 3b3009ea8abb713b022d94fba95ec270cf6e7eae < 6af2a01d65f89e73c1cbb9267f8880d83a88cee4`
- `Linux 6.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.