CVE-2026-63801

A flaw was found in the Linux kernel. A remote attacker could exploit a use-after-free vulnerability in the Transparent Inter-Process Communication (TIPC) cryptographic decryption process. This flaw occurs when a network namespace, a mechanism for isolating network resources, is deallocated before an asynchronous decryption operation completes. This can cause the system to attempt to read from freed memory, potentially leading to a denial of service (DoS) due to a system crash or information disclosure.

This vulnerability is rated as Moderate impact because triggering the race condition requires specific preconditions, including asynchronous crypto offloading during concurrent network namespace deallocation. The TIPC protocol is not loaded or active by default on standard Red Hat Enterprise Linux installations. Systems are only exposed if the TIPC module is deliberately loaded and encryption is configured, where exploitation could result in a denial of service through a kernel crash or unintended memory disclosure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.