The flaw is a list manipulation bug in the Linux kernel’s network handshake code. During the exit of a network namespace, the code mistakenly swaps the arguments to list_splice_init(), preventing the draining of pending handshake requests. As a result, orphaned requests retain references on socket files and memory allocations. The fix reveals a list‑corruption race condition where a concurrent cancel operation can delete a request while a drain loop is iterating over it, corrupting list pointers and potentially triggering a kernel crash. This is a classic list‑corruption weakness (CWE‑821).

All Linux kernel distributions that contain the unpatched net/handshake code are affected. The vulnerability exists in the base kernel prior to the commit that applied the fix. Any system running a kernel version before the upstream patch that addressed CVE‑2026‑63978 is vulnerable. The specific kernel revisions are not listed, but the flaw is identified by patches in the Linux kernel repository.

The CVSS score of 9.8 indicates critical severity. The EPSS score is below 1 %, suggesting a low current likelihood of exploitation, and the vulnerability is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker would need local kernel access to trigger the problematic net namespace exit while pending handshake requests exist, though the exact attack vector is not explicitly detailed in the provided data. If an attacker can cause a namespace exit with pending requests, the list‑corruption race can induce a kernel crash or memory corruption, enabling denial of service or potentially escalating privileges. However, the lack of a publicly available exploit and the low EPSS score imply a low probability of real‑world attacks at present.