Executive brief
A vulnerability in the Linux kernel's IPsec (XFRM) subsystem could allow a local attacker to cause a system crash or potentially execute unauthorized code. The issue stems from how the kernel manages memory when deleting network security states, leading to a 'use-after-free' condition. This could disrupt network operations or allow an attacker to gain elevated privileges on the affected system.
Technical details
A slab-use-after-free vulnerability exists in the Linux kernel's XFRM subsystem within the __xfrm_state_delete function. The root cause is an inconsistent state check where the kernel used value-based predicates (checking x->km.seq or x->id.spi) instead of list-based checks (hlist_unhashed) when unhalshing RCU-protected lists. Under heavy load, a race condition allows a path to observe a non-zero value outside of the xfrm_state_lock, leading to inconsistent list deletion or double-deletion (writing through LIST_POISON). This can be triggered locally to cause a kernel panic or potentially achieve arbitrary code execution. The fix replaces hlist_del_rcu with hlist_del_init_rcu and implements proper hlist_unhashed checks to ensure deletion is idempotent and tracks actual list state.
Affected products
- Linux Linux Kernel 6.12.47 and earlier versions including torvalds/master
Timeline
- 2026-04-29: patched: Initial patch submitted to the Linux kernel tree.
- 2026-05-28: advisory: CVE-2026-46116 published.
References
- https://git.kernel.org/stable/c/14acf9652e5690de3c7486c6db5fb8dafd0a32a3
- https://git.kernel.org/stable/c/26edb0a3c99f9d958c212be68b21f1221614dcf0
- https://git.kernel.org/stable/c/4980162de555cb838f1a189ce7d2cbf5d2e7b050
- https://git.kernel.org/stable/c/a2e2d08fb070fab4947447171f1c4e3ca5a188e5
- https://git.kernel.org/stable/c/b4a53add2fa8f1b5aa17d4c5686c320785fab182