CVE-2026-63919
Received Received - Intake

Linux Kernel XFRM Transport Reinjection Netns Use-After-Free

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: xfrm: input: hold netns during deferred transport reinjection Transport-mode reinjection stores a struct net pointer in skb->cb and uses it later from xfrm_trans_reinject(). That pointer must stay valid until the deferred callback runs. Take a netns reference when queueing deferred reinjection work and drop it after the callback completes. Use maybe_get_net() so the queueing path does not revive a namespace that is already being torn down. This keeps the existing workqueue design and fixes the netns lifetime handling in one place for all users of xfrm_trans_queue_net().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-63919
EUVD
EUVD-2026-45692

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a netns (network namespace) reference handling issue during transport-mode reinjection. When reinjecting packets, a netns pointer is stored in skb->cb and later used by xfrm_trans_reinject(). The problem is that this pointer must remain valid until the deferred callback runs. The fix ensures the netns reference is held during deferred reinjection work and released after completion, preventing use-after-free scenarios.

Detection Guidance

This vulnerability is specific to the Linux kernel's xfrm subsystem and may not have direct detection commands. Monitor kernel logs for xfrm-related errors or crashes, especially during network operations. Check for kernel panics or warnings related to netns (network namespace) handling. Use commands like dmesg | grep xfrm or journalctl -k | grep xfrm to inspect logs.

Impact Analysis

If exploited, this vulnerability could lead to kernel memory corruption or crashes due to invalid netns pointer access. This may cause system instability, denial-of-service conditions, or potential privilege escalation if an attacker can trigger the reinjection path repeatedly.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel issue related to network namespace handling during transport-mode reinjection, which could lead to memory corruption or crashes but does not involve data privacy or security controls typically governed by these regulations.

Mitigation Strategies

Update your Linux kernel to the latest stable version that includes the fix for CVE-2026-63919. If immediate patching is not possible, consider disabling transport-mode reinjection if not required by your system. Monitor vendor advisories for kernel updates and apply them promptly.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63919. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart