CVE-2026-72463

Received Received - Intake

xfrm async resumption use-after-free in Linux kernel

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix dev use-after-free in xfrm async resumption xfrm async resumption hold skb->dev refcnt until after transport_finish. However, xfrm_rcv_cb may modify skb->dev to tunnel dev without taking device reference, such as vti_rcv_cb. The subsequent async resumption will decrement the tunnel device's reference count, which lead to uaf of tunnel dev and refcnt leak of orig dev as below: unregister_netdevice: waiting for vti1 to become free. Usage count = -2 Stash the original skb->dev to fix refcnt imbalance. The new skb->dev set by xfrm_rcv_cb can race with device teardown. Extend rcu protection over xfrm_rcv_cb and transport_finish to prevent races.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72463

EUVD

EUVD-2026-59362

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's xfrm (IPsec) subsystem. It occurs during async resumption when the skb->dev reference count is mishandled. The issue arises because xfrm_rcv_cb can change skb->dev without incrementing the new device's reference count, leading to a reference count underflow and use-after-free when the original device is unregistered.

Detection Guidance

This vulnerability is specific to the Linux kernel's xfrm subsystem and may not have direct detection commands. Monitor kernel logs for messages like 'unregister_netdevice: waiting for vti1 to become free. Usage count = -2' which indicate a use-after-free or reference count issue in network tunnel devices.

Impact Analysis

This vulnerability could cause system instability, crashes, or potential privilege escalation if exploited. Systems using IPsec (xfrm) with async resumption features may experience kernel panics or memory corruption due to the use-after-free condition.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel issue involving device reference counting and use-after-free in the xfrm subsystem. Compliance impacts would only occur if the vulnerability leads to system instability or unauthorized access, which is not described in the provided context.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Update to a kernel version containing the fix for xfrm async resumption. If immediate patching is not possible, consider disabling vulnerable tunnel interfaces like VTI until the fix is applied.

Hi! I’m here to help you understand CVE-2026-72463. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70