Linux Kernel xfrm xfrm_rcv_cb dev use after free

Summaryinfo

A vulnerability was found in Linux Kernel. It has been rated as very critical. Impacted is the function xfrm_rcv_cb of the component xfrm. The manipulation of the argument dev leads to use after free. This vulnerability is referenced as CVE-2026-72463. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability was found in Linux Kernel (version unknown) and classified as very critical. This issue affects the function xfrm_rcv_cb of the component xfrm. The manipulation of the argument dev with an unknown input leads to a use after free vulnerability. Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix dev use-after-free in xfrm async resumption xfrm async resumption hold skb->dev refcnt until after transport_finish. However, xfrm_rcv_cb may modify skb->dev to tunnel dev without taking device reference, such as vti_rcv_cb. The subsequent async resumption will decrement the tunnel device's reference count, which lead to uaf of tunnel dev and refcnt leak of orig dev as below: unregister_netdevice: waiting for vti1 to become free. Usage count = -2 Stash the original skb->dev to fix refcnt imbalance. The new skb->dev set by xfrm_rcv_cb can race with device teardown. Extend rcu protection over xfrm_rcv_cb and transport_finish to prevent races.

It is possible to read the advisory at git.kernel.org. The identification of this vulnerability is CVE-2026-72463 since 08/09/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit. The pricing for an exploit might be around USD $5k-$25k at the moment (estimation calculated on 08/15/2026).

Applying the patch 63a30015199912bd5055bead8001b1ae68a67cdb/8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff is able to eliminate this problem.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion