CVE-2026-63978
CVE-2026-63978 is a critical Linux kernel vulnerability where improper handling of pending handshake requests during network namespace destruction could cause resource leaks and list corruption. The fix involves correcting a list operation order and adding synchronization checks.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel users (no specific products listed)
Real-world impact
Could allow attackers to exploit resource leaks or corruption during network namespace shutdown, potentially leading to denial of service or privilege escalation.
Why this severity
CVSS 9.8 (critical): High confidence in exploitability and severe impact on confidentiality, integrity, and availability.
What to do about it
- 01Apply the latest Linux kernel patch addressing CVE-2026-63978 (verify via distribution updates or kernel source repository).
- 02Rebuild and reinstall the kernel if compiling from source.
NVD description and kernel commit fix documentation
Timeline
- Jul 19, 2026 · 14d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 20, 2026 · 13d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 30, 2026 · 3d agoAdvisory updatedThe NVD record was last revised.