CVE-2026-72463

CriticalCVSS 9.8/10Last modified Oct 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: Fix dev use-after-free in xfrm async resumption

xfrm async resumption hold skb->dev refcnt until after transport_finish. However, xfrm_rcv_cb may modify skb->dev to tunnel dev without taking device reference, such as vti_rcv_cb. The subsequent async resumption will decrement the tunnel device's reference count, which lead to uaf of tunnel dev and refcnt leak of orig dev as below:

unregister_netdevice: waiting for vti1 to become free. Usage count = -2

Stash the original skb->dev to fix refcnt imbalance. The new skb->dev set by xfrm_rcv_cb can race with device teardown. Extend rcu protection over xfrm_rcv_cb and transport_finish to prevent races.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 4236c30b437b80f673b9e08c8fae38b8d471ac9e, < fed4d3195a31125566876952ce66113ec1eb9008; >= 0f451b43c88bf2b9c038b414be580efee42e031b, < 1acd93259b6be269e26be5d71c224bccd1f8352f; >= 1c428b03840094410c5fb6a5db30640486bbbfcb, < 63a30015199912bd5055bead8001b1ae68a67cdb; >= 1c428b03840094410c5fb6a5db30640486bbbfcb, < 8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff; 4d06caedea587c59cc2cc893ceecc57c75c64312; 94439cbe478b53f92223da9aae95fffb28623c3f; 5002beda5cac69d522dc54da0d5d463ed9c963d2; >= 6.12.94, < 6.12.112; >= 6.18.23, < 6.18.54; >= 6.1.191, < 6.2; >= 6.6.160, < 6.7; >= 6.19.13, < 6.20
LinuxLinux7.0

References

Timeline

Published
Aug 15, 2026
Last modified
Oct 30, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-724647.5In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Repost Receive buffers for malformed replies rpcrdma_wc_receCVE-2026-724657.5In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Sanitize the reply credit grant after parsing The out_norqstCVE-2026-724669.8In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix bcall rep leak and unbounded peek rpcrdma_is_bcall() decCVE-2026-72467In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Check frwr_wp_create() during connect frwr_wp_create() creatCVE-2026-72468In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Initialize re_id before removal registration rpcrdma_create_CVE-2026-724698.8In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Fix ep kref imbalance on ADDR_CHANGE rpcrdma_cm_event_handleCVE-2026-72477.2A vulnerability has been found in D-Link DI-8100 16.07.26A1. Affected by this issue is the function file_exten_asp of the file file_exten.asCVE-2026-724707.8In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: resize log->one_page_buf when adopting on-disk page size logCVE-2026-724717.1In the Linux kernel, the following vulnerability has been resolved: fs/ntfs3: prevent potential lcn remains uninitialized The target VCN bCVE-2026-724729.8In the Linux kernel, the following vulnerability has been resolved: nfs: use nfsi->rwsem to protect traversal of the file lock list LingfeCVE-2026-724739.8In the Linux kernel, the following vulnerability has been resolved: xprtrdma: Decouple req recycling from RPC completion rl_kref formerly CVE-2026-72474In the Linux kernel, the following vulnerability has been resolved: dmaengine: dma-axi-dmac: use DMA pool to manange DMA descriptor For ar
CVE-2026-72463: Critical severity, CVSS 9.8 | Vulnix