CVE-2026-63978

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net/handshake: Drain pending requests at net namespace exit

The arguments to list_splice_init() in handshake_net_exit() are

reversed. The call moves the local empty "requests" list onto

hn->hn_requests, leaving the local list empty, so the subsequent

drain loop runs zero iterations. Pending handshake requests that

had not yet been accepted are not torn down when the net namespace

is destroyed; each one keeps a reference on a socket file and on

the handshake_req allocation.

Pass the source and destination in the documented order

(list_splice_init(list, head) moves list onto head) so the pending

list is transferred to the local scratch list and drained through

handshake_complete().

Fixing the splice direction exposes a list-corruption race. After

the splice each req->hr_list still has non-empty link pointers,

threading the stack-local scratch list rather than hn_requests.

A concurrent handshake_req_cancel() -- for ex

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References