CVE-2026-63978

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the net/handshake component where pending requests are not properly drained during net namespace exit. This occurs because the arguments to the list splice init() function in handshake net exit() are reversed, causing the drain loop to run zero iterations. Consequently, pending handshake requests maintain references to socket files and handshake req allocations after the net namespace is destroyed. Correcting the splice direction introduces a list-corruption race condition. A concurrent call to handshake req cancel() can trigger remove pending(), which may call remove pending locked() and list del init() on an entry while the drain is iterating, leading to list corruption or hitting LIST POISON. To resolve this, remove pending() must check the HANDSHAKE F NET DRAINING flag under hn lock and report the request as not found if a drain is in progress. Additionally, using list del init() instead of list del() in the drain prevents req->hr list from carrying LIST POISON after the entry is released.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.