CVE-2026-63978 Overview
CVE-2026-63978 is a Linux kernel vulnerability in the net/handshake subsystem. The flaw stems from reversed arguments passed to list_splice_init() inside handshake_net_exit(). When a network namespace is destroyed, pending handshake requests are not drained, leaving references on socket files and handshake_req allocations. Fixing the splice direction exposes a secondary list-corruption race between the drain loop and a concurrent handshake_req_cancel(), which can free a request while it remains linked on the drain loop's local list.
Critical Impact
The vulnerability enables list corruption and use-after-free conditions in kernel memory, with a network-reachable attack surface through the sunrpc TLS handshake path.
Affected Products
- Linux kernel versions containing the flawed handshake_net_exit() implementation
- Distributions shipping the net/handshake subsystem with sunrpc TLS support
- Systems using kernel TLS handshakes over network namespaces
Discovery Timeline
- 2026-07-19 - CVE-2026-63978 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-63978
Vulnerability Analysis
The defect lies in handshake_net_exit(), where list_splice_init() receives its source and destination arguments in reverse order. The documented signature list_splice_init(list, head) moves list onto head. The buggy call instead moved a local empty requests list onto hn->hn_requests, leaving the local list empty. The subsequent drain loop then ran zero iterations, and pending handshake requests were never torn down at namespace destruction.
Each orphaned request retained a reference on a socket file and on the handshake_req allocation, producing persistent resource leaks tied to network namespace lifetime.
Root Cause
Correcting the splice direction surfaces a second defect. After the fix, each req->hr_list still holds non-empty link pointers that thread through a stack-local scratch list rather than hn_requests. A concurrent handshake_req_cancel() — for example, from sunrpc's TLS timeout on a kernel socket whose netns reference was not taken — locates the request via the rhashtable, calls remove_pending(), and observes !list_empty(&req->hr_list). The call to __remove_pending_locked() then invokes list_del_init() on an entry belonging to the scratch list while the drain iterates, corrupting the list. If the cancel arrives after the drain has executed list_del(), it dereferences LIST_POISON.
Attack Vector
The issue is reachable through the kernel TLS handshake path used by sunrpc. A timeout on a kernel socket whose namespace reference was not taken can trigger handshake_req_cancel() concurrently with namespace teardown. The upstream fix adds a HANDSHAKE_F_NET_DRAINING check under hn_lock inside remove_pending() so that cancel returns not-found while the drain owns the list. The drain now uses list_del_init() to avoid leaving LIST_POISON in req->hr_list, and pins each request's hr_file under hn_lock before releasing the list so sk_destruct cannot free a request that remains linked on the drain's local list.
No public proof-of-concept exploitation code has been released for this issue. Consult the upstream commits referenced in the Kernel Git Commit Update for the authoritative patch content.
Detection Methods for CVE-2026-63978
Indicators of Compromise
- Kernel oops or panic traces referencing handshake_complete, remove_pending, or __remove_pending_locked with LIST_POISON addresses
- Unexpected socket file descriptor leaks associated with network namespace teardown events
- KASAN reports flagging use-after-free within the net/handshake module
Detection Strategies
- Monitor dmesg and kernel audit logs for list-corruption warnings emitted from lib/list_debug.c
- Correlate network namespace exit events with pending TLS handshake activity from sunrpc
- Deploy KASAN- or KFENCE-enabled kernels in test environments to surface memory safety violations before production impact
Monitoring Recommendations
- Track running kernel versions across the fleet and compare against distribution advisories citing the fix commits
- Alert on repeated kernel crashes originating in net/handshake symbols
- Instrument namespace lifecycle events on hosts using kernel TLS (kTLS) with NFS or other sunrpc consumers
How to Mitigate CVE-2026-63978
Immediate Actions Required
- Apply the upstream stable kernel patches referenced by the fix commits 8c35539db0ab, 9ec20c9a5a04, and ea5fe6a73ca5
- Prioritize patching on hosts that create and destroy network namespaces frequently, such as container hosts
- Restrict access to workloads that can trigger sunrpc TLS handshakes over kernel sockets pending a patched kernel
Patch Information
The fix reverses the list_splice_init() argument order so pending requests transfer to the local scratch list and drain through handshake_complete(). It adds a HANDSHAKE_F_NET_DRAINING guard in remove_pending(), converts the drain to list_del_init(), and pins hr_file under hn_lock before releasing the list. Patched sources are available in the Kernel Git Commit Update and Kernel Git Commit Update.
Workarounds
- Disable kernel TLS handshake usage where operationally acceptable until patched kernels are deployed
- Avoid frequent creation and destruction of network namespaces on hosts running vulnerable kernels with active sunrpc TLS consumers
- Reduce exposure by isolating hosts running vulnerable kernels from untrusted network peers that could induce handshake timeouts
# Verify running kernel and check for the fix commits in the changelog
uname -r
rpm -q --changelog kernel | grep -E '8c35539db0ab|9ec20c9a5a04|ea5fe6a73ca5'
# Debian/Ubuntu
apt changelog linux-image-$(uname -r) | grep -E '8c35539db0ab|9ec20c9a5a04|ea5fe6a73ca5'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
