Executive brief
A vulnerability was identified in the Linux kernel's networking subsystem (XFRM) that could lead to system instability or crashes. The issue occurs when the system handles certain types of encrypted network traffic and fails to properly track the lifetime of a network namespace, potentially leading to a use-after-free scenario. This could impact the availability of the system or be used to disrupt network operations.
Technical details
A vulnerability in the Linux kernel's XFRM input processing (net/xfrm/xfrm_input.c) stems from a failure to increment the reference count of a network namespace (netns) pointer stored in the sk_buff control block (skb->cb). During deferred transport-mode reinjection, the pointer is used by xfrm_trans_reinject() after the work is queued; if the namespace is torn down before the callback executes, a use-after-free occurs. The fix introduces the use of maybe_get_net() when queueing work and put_net() upon completion to ensure the namespace remains valid. This issue affects kernels that introduced xfrm_trans_queue_net (starting around version 5.6).
Affected products
- Linux Linux 5.6 to 6.9.x
Timeline
- 2026-07-19: disclosed
- 2026-06-19: patched
References
- https://git.kernel.org/stable/c/2df7059a18afb7d3aee6c36cad5d371c198111d4
- https://git.kernel.org/stable/c/48ce101cd630d6745b6923b5bad8358bc4c119da
- https://git.kernel.org/stable/c/55ddfc41451f01c588089cd74957a05311b6f202
- https://git.kernel.org/stable/c/7ee59eda8820b758ed29e1cd3222359c7b97302c
- https://git.kernel.org/stable/c/8dfabcba6a943a7a02ebe1e1637c361ba96acbaa
- https://git.kernel.org/stable/c/9f67a36e91bb50d358760f381f233913fe5c09f8
- https://git.kernel.org/stable/c/9f7ebb45a83afc3216e855e57d51bb4bc9b5232e