Race condition in Linux kernel - CVE-2026-63978

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a race condition in net/handshake request draining during net namespace exit when canceling pending handshake requests concurrently with namespace teardown. A local user can trigger concurrent handshake request cancellation and net namespace destruction to cause a denial of service.

The issue affects pending handshake requests that have not yet been accepted and can result in list corruption or a request being freed while still linked on the drain loop's local list.

Affected software

How to mitigate CVE-2026-63978

External References

• https://git.kernel.org/stable/c/8c35539db0ab0bfa1ea44efab00b053261a69469
• https://git.kernel.org/stable/c/9ec20c9a5a04f2c3f1cf65d21f886d7aaa6189cd
• https://git.kernel.org/stable/c/ea5fe6a73ca57e5150b8a38b341aef2636eb72f0

Related Security Bulletins

• Race condition in Linux kernel handshake
• Ubuntu update for linux-ibm
• Ubuntu update for linux-azure
• Ubuntu update for linux-aws
• Ubuntu update for linux-nvidia-bos
• Ubuntu update for linux-nvidia