Executive brief
A vulnerability in the Linux kernel's networking subsystem could allow a local user to cause a memory leak. This occurs in the XFRM component, which manages IPsec security policies. Over time, an attacker could repeatedly trigger this leak to exhaust system memory, potentially leading to a system crash or service outage.
Technical details
A reference count leak exists in net/xfrm/xfrm_policy.c within the xfrm_migrate_policy_find() function. The vulnerability is caused by a redundant call to xfrm_pol_hold_rcu() on a policy object that already has an active reference returned by xfrm_policy_lookup_bytype(). This refcount imbalance prevents the policy object from being properly freed, resulting in a memory leak. A local attacker can exploit this to consume kernel memory, eventually leading to a Denial of Service (DoS). Patches have been released for various stable kernel branches including 6.12.y, 6.18.y, and 6.19.y.
Affected products
- Linux Linux Kernel 6.12 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-04-04: other: Patch authored
- 2026-05-06: advisory: Initial NVD publication
- 2026-05-19: patched: NVD analysis and CPE information updated