CVE-2026-72451
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
xfrm: Fix xfrm state cache insertion race
The xfrm input state cache insertion code checks the validity of the state before acquiring the global xfrm_state_lock. Thus it's possible for someone else to kill the state after it passed the validity check, and then the insertion will add the dead state to the cache.
Fix this by moving the validity check inside the lock.
This entire function is called on the input path, where BH must be off (e.g., the caller of this function xfrm_input acquires its spinlocks without disabling BH).
So there is no need to disable BH here or take the RCU read lock. Remove both and replace them with an assertion that trips if BH is accidentally enabled on some future calling path.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability resides in the Linux kernel's IPsec implementation within the xfrm subsystem, specifically affecting the xfrm state cache insertion mechanism. This race condition occurs when multiple threads attempt to insert xfrm states into the cache simultaneously, creating a window where a state can become invalid between the time of validation and the actual insertion operation. The flaw stems from the improper ordering of operations in the state cache insertion code, where validity checks are performed outside of critical sections, leaving room for concurrent modifications that could result in adding invalidated states to the cache.
The technical implementation issue manifests when the xfrm input state cache insertion code performs a validity check on an xfrm state before acquiring the global xfrm_state_lock. This sequence allows another thread to potentially destroy or invalidate the same state after the initial validation but before the lock acquisition, leading to the insertion of a dead state into the cache. The race condition is particularly problematic because it can result in inconsistent state management and potential security implications within the IPsec framework. This vulnerability directly relates to CWE-362, which describes concurrent execution using shared data structures without proper synchronization mechanisms.
The operational impact of this vulnerability extends across all systems utilizing Linux kernel IPsec functionality, particularly affecting network security implementations that rely on xfrm state caching for performance optimization. Systems processing high volumes of IPsec traffic or those with concurrent state management operations are most susceptible to exploitation. The issue can lead to cache corruption, invalid state references, and potentially compromise the integrity of IPsec connections. Additionally, the vulnerability affects systems using kernel versions where the xfrm subsystem handles incoming packets through the xfrm_input function, which operates in interrupt context requiring specific locking mechanisms.
Security implications include potential denial of service conditions where invalid states corrupt the cache, leading to connection failures or packet drops. The vulnerability could also enable attackers to manipulate the state cache in ways that might affect traffic routing or authentication mechanisms within IPsec implementations. Furthermore, the race condition may create opportunities for privilege escalation or information disclosure if exploited properly, particularly in environments with complex network security policies.
The fix addresses this by reordering the operations to move the validity check inside the critical section protected by xfrm_state_lock, ensuring that no other thread can modify the state between validation and insertion. This solution eliminates the race condition by making the entire validation and insertion process atomic. The patch also removes unnecessary BH (bottom half) disabling operations and RCU read lock acquisitions that were present in the function, replacing them with assertion checks to prevent accidental enabling of BH on future code paths. This approach aligns with best practices for kernel synchronization and follows ATT&CK technique T1068 by addressing privilege escalation vectors through proper resource management.
The mitigation strategy involves applying the kernel patch that repositions the validity check within the lock, ensuring atomicity of state validation and insertion operations. System administrators should prioritize updating to affected kernel versions containing this fix, particularly in production environments handling sensitive network traffic. Monitoring for cache corruption indicators and implementing proper logging of xfrm state operations can help detect potential exploitation attempts. The solution maintains performance characteristics while eliminating the race condition that could lead to system instability or security compromise.