Executive brief
The Linux kernel's packet encryption and decryption subsystem (xfrm) contains a memory safety flaw that can occur when processing IPv6 packets. When certain network queue types are configured, freed memory can be accessed during packet transmission, potentially causing system crashes or undefined behavior that could compromise system stability.
Technical details
This is a use-after-free vulnerability in the xfrm subsystem's decode_session6 function. The root cause is that xfrm_decode_session was originally designed for the receive path only, but is being called during transmission. When the cb (control buffer) field of an skb is modified by the qdisc layer (specifically with sfb qdisc), the IP6CB(skb)->nhoff field—which was never set during transmission—can point to freed memory. An attacker or misconfiguration that triggers IPv6 packet transmission through an xfrm device with sfb qdisc can trigger the use-after-free. The fix involves zeroing the skb's cb field before transmission to prevent accessing stale values. This is a kernel-level vulnerability with no user-space exploitation vector.
Affected products
- Linux Linux kernel 6.4.0 and earlier (vulnerability fixed in subsequent releases)
Timeline
- 2025-10-01: disclosed