In the Linux kernel, the following vulnerability has been resolved: net/handshake: restore destructor on submit failure handshake_req_submit() replaces sk->sk_destruct but never restores it when submission fails before the request is hashed. handshake_sk_destruct() then returns early and the original destructor never runs, leaking the socket. Restore sk_destruct on the error path.
| Product | Vendor | Version |
|---|---|---|
| Linux | Linux | <= 5.15.* |
| Linux | Linux | <= 5.18.* |
| Linux | Linux | >= 1.1.0, < 1.1.31 |