CVE-2026-72137
Received Received - Intake

BaseFortify

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: xfrm: nat_keepalive: avoid double free on send error nat_keepalive_send() frees the keepalive skb whenever the IPv4 or IPv6 send helper reports an error. That cleanup is only correct before the skb is handed to the output path. Once ip_build_and_send_pkt() or ip6_xmit() takes ownership, the networking stack may already have consumed the skb before returning an error, so freeing it again is unsafe. Handle the pre-handoff failure cases inside nat_keepalive_send_ipv4() and nat_keepalive_send_ipv6(), where the caller still owns the skb, and keep nat_keepalive_send() responsible only for family dispatch and the unsupported-family cleanup path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72137
EUVD
EUVD-2026-58895

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a double free issue in the xfrm nat_keepalive functionality. The nat_keepalive_send() function incorrectly frees the keepalive skb when IPv4 or IPv6 send helpers report an error, but this cleanup is only safe before the skb is passed to the output path. After handing off to ip_build_and_send_pkt() or ip6_xmit(), the networking stack may have already consumed the skb, making a second free unsafe.

Detection Guidance

This vulnerability is specific to the Linux kernel's xfrm subsystem and involves a double free issue in nat_keepalive_send(). Detection requires checking kernel logs for crashes or memory corruption related to xfrm or nat_keepalive functions. Commands like dmesg, journalctl -k, or checking for kernel oops messages may help identify related issues.

Impact Analysis

This vulnerability could lead to kernel memory corruption or crashes if exploited. It may cause system instability, denial of service, or potential privilege escalation if an attacker triggers the double free condition.

Mitigation Strategies

Apply the latest kernel security patches from your Linux distribution. If patches are not yet available, consider disabling the xfrm nat_keepalive feature if not required. Monitor vendor advisories for updates and test patches in a non-production environment before deployment.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72137. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart