CVE-2026-72463
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
xfrm: Fix dev use-after-free in xfrm async resumption
xfrm async resumption hold skb->dev refcnt until after transport_finish. However, xfrm_rcv_cb may modify skb->dev to tunnel dev without taking device reference, such as vti_rcv_cb. The subsequent async resumption will decrement the tunnel device's reference count, which lead to uaf of tunnel dev and refcnt leak of orig dev as below:
unregister_netdevice: waiting for vti1 to become free. Usage count = -2
Stash the original skb->dev to fix refcnt imbalance. The new skb->dev set by xfrm_rcv_cb can race with device teardown. Extend rcu protection over xfrm_rcv_cb and transport_finish to prevent races.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/15/2026
The vulnerability described represents a critical use-after-free condition in the Linux kernel's IPsec eXtensible Remote eXecution Model implementation, specifically within the asynchronous resumption mechanism of the xfrm subsystem. This flaw manifests when processing incoming packets through the IPsec framework, where the kernel maintains reference counts on network devices to manage their lifecycle properly. The issue occurs during packet processing when a packet initially references one network device but gets redirected through an IPsec tunnel to another device, creating a complex reference counting scenario that can lead to system instability and potential privilege escalation.
The technical root cause stems from improper handling of network device references within the xfrm subsystem's asynchronous packet processing pipeline. The xfrm async resumption mechanism attempts to maintain the original packet's device reference by holding an skb->dev reference count until after transport_finish completes. However, when xfrm_rcv_cb functions such as vti_rcv_cb modify the skb->dev pointer to point to a tunnel device without properly acquiring a reference to that new device, a race condition emerges. This occurs because the original device's reference count gets decremented during async resumption while the new tunnel device may already be in the process of being torn down or has already been freed, creating a situation where memory access occurs after deallocation.
The operational impact of this vulnerability extends beyond simple system crashes to potentially enable privilege escalation attacks within the kernel space. When the reference count imbalance occurs, as evidenced by the error message "unregister_netdevice: waiting for vti1 to become free. Usage count = -2", the kernel's device management subsystem becomes corrupted, leading to potential denial of service conditions and memory corruption that could be exploited by malicious actors. The race condition between xfrm_rcv_cb execution and transport_finish completion creates an unpredictable window where device references may become invalid while still being accessed.
The proposed fix addresses this issue through multiple protective mechanisms that align with established security practices and kernel development standards. The solution involves stashing the original skb->dev reference to prevent the reference count imbalance that leads to use-after-free conditions, while also extending RCU (Read-Copy-Update) protection over both xfrm_rcv_cb and transport_finish operations. This approach prevents race conditions by ensuring that device references remain valid throughout the entire processing sequence, thereby protecting against concurrent access patterns that could lead to memory corruption. The fix demonstrates adherence to CWE principles related to improper handling of resource references and race conditions in kernel code.
Implementation of these mitigations ensures proper reference counting semantics are maintained throughout the packet processing pipeline, preventing scenarios where network device structures become prematurely freed while still being referenced by ongoing asynchronous operations. The solution addresses fundamental issues in kernel networking subsystem design and aligns with ATT&CK framework concepts related to privilege escalation through kernel vulnerabilities. By properly managing device reference counts and extending synchronization mechanisms over critical code paths, the fix prevents both immediate system crashes and more subtle exploitation vectors that could arise from memory corruption in kernel space operations.