CVE-2026-63979
This vulnerability is a race condition in the Linux kernel’s network handshake code that can cause a use‑after‑free or null pointer dereference, potentially crashing the system or allowing privilege escalation. It occurs when a handshake request is cancelled while the accept side is still processing it. The issue has been fixed in the kernel.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel – any distribution running a kernel version before the patch. Typical users include system administrators and Linux users.
Real-world impact
An attacker could trigger a kernel crash or gain elevated privileges by exploiting the race condition, leading to denial of service or unauthorized access.
Why this severity
The CVSS score of 9.8 reflects a critical vulnerability that can be exploited over the network with low effort, requires no privileges or user interaction, and compromises confidentiality, integrity, and availability.
What to do about it
- 01Upgrade your Linux kernel to the latest patched version that includes the fix.
- 02Reboot the system to load the new kernel.
NVD description indicates the vulnerability has been resolved in the Linux kernel.
Timeline
- Jul 19, 2026 · 14d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 20, 2026 · 13d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.
- Jul 30, 2026 · 3d agoAdvisory updatedThe NVD record was last revised.