CVE-2026-72463

xfrm: Fix dev use-after-free in xfrm async resumption

State: Published
Severity: 9.8 Critical
Published: Aug 15, 2026
Updated: Oct 30, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: Fix dev use-after-free in xfrm async resumption

xfrm async resumption hold skb->dev refcnt until after transport_finish. However, xfrm_rcv_cb may modify skb->dev to tunnel dev without taking device reference, such as vti_rcv_cb. The subsequent async resumption will decrement the tunnel device's reference count, which lead to uaf of tunnel dev and refcnt leak of orig dev as below:

unregister_netdevice: waiting for vti1 to become free. Usage count = -2

Stash the original skb->dev to fix refcnt imbalance. The new skb->dev set by xfrm_rcv_cb can race with device teardown. Extend rcu protection over xfrm_rcv_cb and transport_finish to prevent races.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	4236c30b437b80f673b9e08c8fae38b8d471ac9e to before fed4d3195a31125566876952ce66113ec1eb9008Affected 0f451b43c88bf2b9c038b414be580efee42e031b to before 1acd93259b6be269e26be5d71c224bccd1f8352fAffected 1c428b03840094410c5fb6a5db30640486bbbfcb to before 63a30015199912bd5055bead8001b1ae68a67cdbAffected 1c428b03840094410c5fb6a5db30640486bbbfcb to before 8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ffAffected 4d06caedea587c59cc2cc893ceecc57c75c64312Affected 94439cbe478b53f92223da9aae95fffb28623c3fAffected 5002beda5cac69d522dc54da0d5d463ed9c963d2Affected 6.12.94 to before 6.12.112Affected 6.18.23 to before 6.18.54Affected 6.1.191 to before 6.2Affected 6.6.160 to before 6.7Affected 6.19.13 to before 6.20Affected
LinuxLinux	7.0Affected before 7.0Not affected 6.12.112 through 6.12.Not affected 6.18.54 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

4236c30b437b80f673b9e08c8fae38b8d471ac9e to before fed4d3195a31125566876952ce66113ec1eb9008Affected
0f451b43c88bf2b9c038b414be580efee42e031b to before 1acd93259b6be269e26be5d71c224bccd1f8352fAffected
1c428b03840094410c5fb6a5db30640486bbbfcb to before 63a30015199912bd5055bead8001b1ae68a67cdbAffected
1c428b03840094410c5fb6a5db30640486bbbfcb to before 8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ffAffected
4d06caedea587c59cc2cc893ceecc57c75c64312Affected
94439cbe478b53f92223da9aae95fffb28623c3fAffected
5002beda5cac69d522dc54da0d5d463ed9c963d2Affected
6.12.94 to before 6.12.112Affected
6.18.23 to before 6.18.54Affected
6.1.191 to before 6.2Affected
6.6.160 to before 6.7Affected
6.19.13 to before 6.20Affected

LinuxLinux

7.0Affected
before 7.0Not affected
6.12.112 through 6.12.*Not affected
6.18.54 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.