🟠 High | Source: Microsoft Security Response Center
CVE-2026-63978 is a Linux kernel vulnerability in the net/handshake subsystem, where pending TLS handshake requests are not properly drained when a network namespace exits. This can lead to resource mismanagement or potential memory corruption conditions. Microsoft has published this advisory in the context of Azure, suggesting it may affect Linux-based Azure workloads or underlying infrastructure components.
Security Architect’s Take: Review any Linux-based Azure VMs or AKS node pools running kernel versions affected by this flaw and apply available patches promptly. Prioritise workloads that handle TLS termination or operate across multiple network namespaces, such as containerised environments, as they carry the greatest exposure.
Original advisory: CVE-2026-63978 net/handshake: Drain pending requests at net namespace exit