Executive brief
A vulnerability was identified in the Linux kernel's networking subsystem, specifically within the component responsible for IPsec (XFRM) packet processing. Under certain conditions involving asynchronous encryption, the system may prematurely release a reference to a network device while it is still in use. This can lead to a system crash or unpredictable behavior, potentially allowing a local attacker to disrupt operations or gain unauthorized access.
Technical details
A race condition exists in the Linux kernel's XFRM implementation (net/xfrm/xfrm_input.c). When asynchronous crypto operations complete, xfrm_input_resume() calls dev_put() on the network device reference before the socket buffer (skb) reaches the transport_finish stage. This allows the skb->dev pointer to be used within NF_HOOK and its associated functions after the device may have been torn down. An attacker with local access could potentially exploit this race condition to cause a kernel panic or achieve privilege escalation. The fix involves delaying the dev_put() call until after the NF_HOOK execution is complete.
Affected products
- Linux Linux 4.15 to 7.0
Timeline
- 2026-04-24: advisory: Initial disclosure of CVE-2026-31663
- 2026-04-18: patched: Fix committed to Linux stable tree