CVE-2026-64580
Received Received - Intake

Double Netdev Put in Linux Kernel XFRM6

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() On the error path where in6_dev_get(dev) returns NULL, xfrm6_fill_dst() releases the device reference with netdev_put() but leaves xdst->u.dst.dev set. dst_destroy() later calls netdev_put(dst->dev) again, so the same net_device reference is released twice, underflowing its refcount (ref_tracker WARNING + "unregister_netdevice: waiting for <dev> to become free"). Clear xdst->u.dst.dev after the netdev_put(), the same way the XFRM device-offload paths xfrm_dev_state_add() and xfrm_dev_policy_add() in net/xfrm/xfrm_device.c NULL ->dev when releasing the reference on error. ref_tracker: reference already released. ref_tracker: allocated in: xfrm6_fill_dst (net/ipv6/xfrm6_policy.c:86) ... udpv6_sendmsg (net/ipv6/udp.c:1696) ... ref_tracker: freed in: xfrm6_fill_dst (net/ipv6/xfrm6_policy.c:90) ... WARNING: lib/ref_tracker.c:322 at ref_tracker_free+0x58b/0x780 dst_destroy (net/core/dst.c:115) rcu_core handle_softirqs ...

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-64580
EUVD
EUVD-2026-53274

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where a double release of a network device reference occurs. When xfrm6_fill_dst() fails to get a device reference, it incorrectly releases the reference but leaves the device pointer set. Later, dst_destroy() tries to release the same reference again, causing a refcount underflow and potential system instability.

Detection Guidance

This vulnerability may trigger kernel warnings like 'ref_tracker: reference already released' or 'unregister_netdevice: waiting for <dev> to become free'. Monitor kernel logs for these messages using commands like 'dmesg | grep -i ref_tracker' or 'journalctl -k | grep -i unregister_netdevice'.

Impact Analysis

This could lead to kernel crashes or hangs due to corrupted reference counts. Systems using IPsec (xfrm) in IPv6 networking may experience unexpected reboots or network failures when processing certain packets.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level kernel issue involving memory management and device reference counting, which could lead to system instability or crashes but does not involve data exposure or privacy violations.

Mitigation Strategies

Apply the latest Linux kernel security patches from your distribution. If immediate patching is not possible, consider disabling IPv6 XFRM policies temporarily as a workaround until the fix is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64580. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart