CVE-2026-92489
Received
Received - Intake
BaseFortify
Vulnerability report for CVE-2026-92489, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-09-17
Last updated on: 2026-09-18
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
xfrm: Fix skb double-free in xfrm_dev_direct_output()
A return value other than 1 from local_out() means that the skb has been
consumed or its ownership was transferred. xfrm_dev_direct_output()
nevertheless frees the skb on this path, causing a double-free when
netfilter drops the packet and invalidating any other owner.
Return the local_out() result directly, matching the ownership handling
in xfrm_output_resume().
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Linux | Linux | bfb9b9404a53a72524ce695551755117e9d3deb0 |
| Linux | Linux | a0395e96831adee8ffa016bf958e4dce9ece656e |
| Linux | Linux | 5eddd76ec2fd1988f0a3450fde9730b10dd22992 |
| Linux | Linux | 5eddd76ec2fd1988f0a3450fde9730b10dd22992 |
| Linux | Linux | 5eddd76ec2fd1988f0a3450fde9730b10dd22992 |
| Linux | Linux | d1d673a5bede3767252cff19c0ab1e5387c6f43f |
| Linux | Linux | 6.6.85 |
| Linux | Linux | 6.12.21 |
| Linux | Linux | 6.13.9 |
| Linux | Linux | 6.14 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
