The vulnerability (CVE-2026-63978) in the Linux kernel's net/handshake subsystem was due to reversed arguments in list_splice_init() within handshake_net_exit(), which caused the local 'requests' list to be emptied incorrectly, preventing pending handshake requests from being properly drained when a network namespace was destroyed. This left references on socket files and handshake_req allocations, causing resource leaks. Fixing the splice direction exposed a race condition where concurrent handshake_req_cancel() calls could corrupt the list being drained. The patch introduced a DRAINING guard under a lock to prevent concurrent removal during draining, used list_del_init() to avoid LIST_POISON issues, and pinned each request's hr_file reference to prevent premature freeing during the drain loop.

The vulnerability allows pending handshake requests to persist after network namespace destruction, leading to resource leaks and potential list corruption due to race conditions. This can result in denial of service or kernel instability. The CVSS score of 9.8 indicates critical impact with high confidentiality, integrity, and availability consequences.

A fix is available that corrects the list_splice_init() argument order and adds synchronization to prevent race conditions during draining and cancellation of handshake requests. Users should apply the official Linux kernel patch that addresses CVE-2026-63978. Since no affected versions or patch links are explicitly provided, check the vendor or Linux kernel mailing lists for the relevant patch and update guidance.