GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-63978 (GCVE-0-2026-63978)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:56 – Updated: 2026-08-09 18:34
VLAI
Title
net/handshake: Drain pending requests at net namespace exit
Summary
In the Linux kernel, the following vulnerability has been resolved: net/handshake: Drain pending requests at net namespace exit The arguments to list_splice_init() in handshake_net_exit() are reversed. The call moves the local empty "requests" list onto hn->hn_requests, leaving the local list empty, so the subsequent drain loop runs zero iterations. Pending handshake requests that had not yet been accepted are not torn down when the net namespace is destroyed; each one keeps a reference on a socket file and on the handshake_req allocation. Pass the source and destination in the documented order (list_splice_init(list, head) moves list onto head) so the pending list is transferred to the local scratch list and drained through handshake_complete(). Fixing the splice direction exposes a list-corruption race. After the splice each req->hr_list still has non-empty link pointers, threading the stack-local scratch list rather than hn_requests. A concurrent handshake_req_cancel() -- for example, from sunrpc's TLS timeout on a kernel socket whose netns reference was not taken -- finds the request through the rhashtable, calls remove_pending(), and sees !list_empty(&req->hr_list). __remove_pending_locked() then list_del_init()s an entry off the scratch list while the drain iterates, corrupting it. The same call arriving after the drain loop has run list_del() on an entry hits LIST_POISON instead. Have remove_pending() check HANDSHAKE_F_NET_DRAINING under hn_lock and report not-found when drain is in progress. The drain has already taken ownership; handshake_complete()'s existing test_and_set on HANDSHAKE_F_REQ_COMPLETED still arbitrates between drain and cancel for who calls the consumer's hp_done. Use list_del_init() rather than list_del() in the drain so req->hr_list does not carry LIST_POISON after drain releases the entry. The DRAINING guard in remove_pending() makes cancel return false, but cancel still falls through to test_and_set_bit on HANDSHAKE_F_REQ_COMPLETED and drops the request's hr_file reference. Without another pin, if that is the last reference, sk_destruct frees the request while it is still linked on the drain loop's local list. Pin each request's hr_file under hn_lock before releasing the list, and drop that drain pin after the loop finishes with the request.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 3b3009ea8abb713b022d94fba95ec270cf6e7eae , < 9ec20c9a5a04f2c3f1cf65d21f886d7aaa6189cd (git)
Affected: 3b3009ea8abb713b022d94fba95ec270cf6e7eae , < 2bf24a7e190aae0ea47c78099938ae056c622e44 (git)
Affected: 3b3009ea8abb713b022d94fba95ec270cf6e7eae , < 8c35539db0ab0bfa1ea44efab00b053261a69469 (git)
Affected: 3b3009ea8abb713b022d94fba95ec270cf6e7eae , < ea5fe6a73ca57e5150b8a38b341aef2636eb72f0 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.4
Unaffected: 0 , < 6.4 (semver)
Unaffected: 6.12.93 , ≤ 6.12.* (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.0.12 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/handshake/netlink.c",
            "net/handshake/request.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9ec20c9a5a04f2c3f1cf65d21f886d7aaa6189cd",
              "status": "affected",
              "version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae",
              "versionType": "git"
            },
            {
              "lessThan": "2bf24a7e190aae0ea47c78099938ae056c622e44",
              "status": "affected",
              "version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae",
              "versionType": "git"
            },
            {
              "lessThan": "8c35539db0ab0bfa1ea44efab00b053261a69469",
              "status": "affected",
              "version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae",
              "versionType": "git"
            },
            {
              "lessThan": "ea5fe6a73ca57e5150b8a38b341aef2636eb72f0",
              "status": "affected",
              "version": "3b3009ea8abb713b022d94fba95ec270cf6e7eae",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/handshake/netlink.c",
            "net/handshake/request.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.4"
            },
            {
              "lessThan": "6.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/handshake: Drain pending requests at net namespace exit\n\nThe arguments to list_splice_init() in handshake_net_exit() are\nreversed. The call moves the local empty \"requests\" list onto\nhn-\u003ehn_requests, leaving the local list empty, so the subsequent\ndrain loop runs zero iterations. Pending handshake requests that\nhad not yet been accepted are not torn down when the net namespace\nis destroyed; each one keeps a reference on a socket file and on\nthe handshake_req allocation.\n\nPass the source and destination in the documented order\n(list_splice_init(list, head) moves list onto head) so the pending\nlist is transferred to the local scratch list and drained through\nhandshake_complete().\n\nFixing the splice direction exposes a list-corruption race. After\nthe splice each req-\u003ehr_list still has non-empty link pointers,\nthreading the stack-local scratch list rather than hn_requests.\nA concurrent handshake_req_cancel() -- for example, from sunrpc\u0027s\nTLS timeout on a kernel socket whose netns reference was not\ntaken -- finds the request through the rhashtable, calls\nremove_pending(), and sees !list_empty(\u0026req-\u003ehr_list).\n__remove_pending_locked() then list_del_init()s an entry off the\nscratch list while the drain iterates, corrupting it. The same\ncall arriving after the drain loop has run list_del() on an\nentry hits LIST_POISON instead.\n\nHave remove_pending() check HANDSHAKE_F_NET_DRAINING under\nhn_lock and report not-found when drain is in progress. The\ndrain has already taken ownership; handshake_complete()\u0027s existing\ntest_and_set on HANDSHAKE_F_REQ_COMPLETED still arbitrates\nbetween drain and cancel for who calls the consumer\u0027s hp_done. Use\nlist_del_init() rather than list_del() in the drain so req-\u003ehr_list\ndoes not carry LIST_POISON after drain releases the entry.\n\nThe DRAINING guard in remove_pending() makes cancel return false,\nbut cancel still falls through to test_and_set_bit on\nHANDSHAKE_F_REQ_COMPLETED and drops the request\u0027s hr_file reference.\nWithout another pin, if that is the last reference, sk_destruct frees\nthe request while it is still linked on the drain loop\u0027s local list.\nPin each request\u0027s hr_file under hn_lock before releasing the list,\nand drop that drain pin after the loop finishes with the request."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - Pending handshake requests are created by network-facing kernel TLS consumers (nfsd via `tls_server_hello_x509()` in sunrpc, nvmet-tcp via `tls_server_hello_psk()`), reachable from unauthenticated remote TCP connections before credentials are verified; the bug fires when that namespace is torn down while those requests remain pending.\nAC:L - An attacker can reliably orchestrate the failure by opening TLS connections to leave handshakes pending, then destroying the namespace (user/net namespace or container teardown) and waiting for the predictable sunrpc/NVMe TLS timeout to invoke `handshake_req_cancel()` against freed per-net state.\nPR:N - No server-side privileges are required to reach the vulnerable path\u2014remote peers can initiate the pre-authentication TLS handshake that queues pending requests; namespace teardown is also achievable without init-namespace root via user namespaces granting CAP_SYS_ADMIN.\nUI:N - Exploitation requires no victim interaction beyond the attacker (or orchestrator) initiating connections and namespace lifecycle events; no end-user actions such as mounting filesystems or opening files are needed.\nS:U - Impact is confined to kernel memory corruption and host availability within the same kernel security domain; it does not cross a VM, container sandbox, or IOMMU boundary to affect a separate security authority.\nC:H - Undrained requests leave `handshake_req` objects and freed `handshake_net` state reachable through the global rhashtable; concurrent `handshake_req_cancel()` dereferences freed `hn_lock`/`hn_requests` and can hit LIST_POISON, constituting use-after-free with arbitrary-read potential.\nI:H - The reversed `list_splice_init()` and ensuing drain/cancel races corrupt kernel linked lists and free in-use `handshake_req` structures while still linked, enabling memory corruption exploitable for control-flow hijacking.\nA:H - List corruption and use-after-free on namespace exit or concurrent cancel reliably cause kernel oops/panic or deadlock-class failures, and repeated namespace churn with pending handshakes enables sustained denial of service on the host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-09T18:34:55.102Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9ec20c9a5a04f2c3f1cf65d21f886d7aaa6189cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/2bf24a7e190aae0ea47c78099938ae056c622e44"
        },
        {
          "url": "https://git.kernel.org/stable/c/8c35539db0ab0bfa1ea44efab00b053261a69469"
        },
        {
          "url": "https://git.kernel.org/stable/c/ea5fe6a73ca57e5150b8a38b341aef2636eb72f0"
        }
      ],
      "title": "net/handshake: Drain pending requests at net namespace exit",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63978",
    "datePublished": "2026-07-19T14:56:02.484Z",
    "dateReserved": "2026-07-19T07:54:57.025Z",
    "dateUpdated": "2026-08-09T18:34:55.102Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-63978",
      "date": "2026-09-04",
      "epss": "0.00618",
      "percentile": "0.4731"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-11T14:41:15.000Z",
      "cve": "CVE-2026-63978",
      "id": "msrc_CVE-2026-63978",
      "initial_release_date": "2026-07-21T01:04:58.000Z",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net/handshake: Drain pending requests at net namespace exit",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-63978.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-63978\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-19T16:17:16.957\",\"lastModified\":\"2026-08-09T19:17:01.670\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/handshake: Drain pending requests at net namespace exit\\n\\nThe arguments to list_splice_init() in handshake_net_exit() are\\nreversed. The call moves the local empty \\\"requests\\\" list onto\\nhn-\u003ehn_requests, leaving the local list empty, so the subsequent\\ndrain loop runs zero iterations. Pending handshake requests that\\nhad not yet been accepted are not torn down when the net namespace\\nis destroyed; each one keeps a reference on a socket file and on\\nthe handshake_req allocation.\\n\\nPass the source and destination in the documented order\\n(list_splice_init(list, head) moves list onto head) so the pending\\nlist is transferred to the local scratch list and drained through\\nhandshake_complete().\\n\\nFixing the splice direction exposes a list-corruption race. After\\nthe splice each req-\u003ehr_list still has non-empty link pointers,\\nthreading the stack-local scratch list rather than hn_requests.\\nA concurrent handshake_req_cancel() -- for example, from sunrpc\u0027s\\nTLS timeout on a kernel socket whose netns reference was not\\ntaken -- finds the request through the rhashtable, calls\\nremove_pending(), and sees !list_empty(\u0026req-\u003ehr_list).\\n__remove_pending_locked() then list_del_init()s an entry off the\\nscratch list while the drain iterates, corrupting it. The same\\ncall arriving after the drain loop has run list_del() on an\\nentry hits LIST_POISON instead.\\n\\nHave remove_pending() check HANDSHAKE_F_NET_DRAINING under\\nhn_lock and report not-found when drain is in progress. The\\ndrain has already taken ownership; handshake_complete()\u0027s existing\\ntest_and_set on HANDSHAKE_F_REQ_COMPLETED still arbitrates\\nbetween drain and cancel for who calls the consumer\u0027s hp_done. Use\\nlist_del_init() rather than list_del() in the drain so req-\u003ehr_list\\ndoes not carry LIST_POISON after drain releases the entry.\\n\\nThe DRAINING guard in remove_pending() makes cancel return false,\\nbut cancel still falls through to test_and_set_bit on\\nHANDSHAKE_F_REQ_COMPLETED and drops the request\u0027s hr_file reference.\\nWithout another pin, if that is the last reference, sk_destruct frees\\nthe request while it is still linked on the drain loop\u0027s local list.\\nPin each request\u0027s hr_file under hn_lock before releasing the list,\\nand drop that drain pin after the loop finishes with the request.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/handshake/netlink.c\",\"net/handshake/request.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3b3009ea8abb713b022d94fba95ec270cf6e7eae\",\"lessThan\":\"9ec20c9a5a04f2c3f1cf65d21f886d7aaa6189cd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3b3009ea8abb713b022d94fba95ec270cf6e7eae\",\"lessThan\":\"2bf24a7e190aae0ea47c78099938ae056c622e44\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3b3009ea8abb713b022d94fba95ec270cf6e7eae\",\"lessThan\":\"8c35539db0ab0bfa1ea44efab00b053261a69469\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3b3009ea8abb713b022d94fba95ec270cf6e7eae\",\"lessThan\":\"ea5fe6a73ca57e5150b8a38b341aef2636eb72f0\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/handshake/netlink.c\",\"net/handshake/request.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.93\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.44\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.12\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2bf24a7e190aae0ea47c78099938ae056c622e44\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8c35539db0ab0bfa1ea44efab00b053261a69469\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9ec20c9a5a04f2c3f1cf65d21f886d7aaa6189cd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ea5fe6a73ca57e5150b8a38b341aef2636eb72f0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-22T03:07:30+00:00",
      "cve": "CVE-2026-63978",
      "id": "CVE-2026-63978",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "184",
      "product_status:known_not_affected": "90",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/handshake: Drain pending requests at net namespace exit",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-63978.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.