CVE-2026-63801 is a slab-use-after-free vulnerability in the Linux kernel's TIPC crypto decrypt path. The function tipc_aead_decrypt() calls crypto_aead_decrypt() asynchronously without taking a reference on the network namespace (netns), unlike the encrypt path. If the netns is torn down during the asynchronous operation, the completion callback tipc_aead_decrypt_done() dereferences freed memory, leading to a use-after-free. The fix involves taking a net reference before crypto_aead_decrypt(), maintaining it across asynchronous returns, and releasing it properly after completion, preventing access to freed memory.

The vulnerability allows the kernel to read freed memory during asynchronous decryption operations in TIPC, which can lead to undefined behavior such as kernel crashes or potential information disclosure. The issue arises when the network namespace is destroyed while an asynchronous decrypt operation is pending, causing use-after-free reads in kernel memory.

A fix for this vulnerability has been implemented upstream by adding proper network namespace reference counting in the decrypt path to prevent use-after-free conditions. Users should apply the official Linux kernel patches that include this fix. Since this is a kernel vulnerability, upgrading to a kernel version containing this patch is the recommended remediation. Patch status is not explicitly confirmed here; check the vendor or Linux kernel advisories for the exact fixed versions and apply updates accordingly.