Executive brief
The Linux kernel's IPsec implementation (xfrm) contains a use-after-free vulnerability in asynchronous packet processing that affects tunnel devices. An attacker with network access can trigger incorrect device reference counting during async resumption, potentially crashing the system or causing memory corruption. This impacts the stability and security of systems using IPsec tunnels or VPN functionality.
Technical details
The vulnerability exists in net/xfrm/xfrm_input.c where async resumption holds a reference to skb->dev until after transport_finish. However, xfrm_rcv_cb (specifically vti_rcv_cb for tunnel devices) can modify skb->dev without taking an additional device reference. When async resumption later decrements the tunnel device's reference count, this creates a use-after-free condition and reference count leak on the original device. The fix stashes the original skb->dev in a local variable and extends RCU read-side critical sections over xfrm_rcv_cb and transport_finish to prevent race conditions with device teardown. The patch modifies net/ipv4/xfrm4_input.c, net/ipv6/xfrm6_input.c, and net/xfrm/xfrm_input.c.
Affected products
- Linux Linux kernel all versions before commit 8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff
Timeline
- 2026-08-15: disclosed: CVE published on NVD
- 2026-06-12: patched: Upstream fix commit 8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff
- 2026-06-09: other: Patch authored by Dong Chenchen