Executive brief
The Linux kernel's IPsec transform (xfrm) module has a double-free memory bug in its packet offloading code path. When netfilter drops an encrypted packet during transmission, the kernel incorrectly frees memory that was already freed or transferred to another owner, causing a kernel crash or memory corruption that could lead to system instability or privilege escalation.
Technical details
The vulnerability is a use-after-free caused by incorrect memory ownership handling in xfrm_dev_direct_output(). When the local_out() function returns a value other than 1, it indicates the socket buffer (skb) has been consumed or transferred; however, the vulnerable code still executes kfree_skb(), causing a double-free. The bug occurs in the IPsec packet offload TX path when netfilter processes packets. The fix removes the erroneous kfree_skb() call and returns the local_out() result directly, matching the ownership semantics used in xfrm_output_resume(). This is a kernel-space memory corruption issue reachable via network-based IPsec packet processing.
Affected products
- Linux Linux Kernel Affected versions prior to fix commit 2aed51fc58d9ce450e2c116efb956160fd06fa02; introduced by commit 5eddd76ec2fd
Timeline
- 2026-09-17: disclosed: CVE-2026-92489 published
- 2026-07-22: patched: Fix commit 2aed51fc58d9ce450e2c116efb956160fd06fa02 authored
- 2026-09-14: other: Patch merged into stable kernel tree by Greg Kroah-Hartman