{"id":"CVE-2026-72463","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-72463","summary":"xfrm: Fix dev use-after-free in xfrm async resumption","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: Fix dev use-after-free in xfrm async resumption\n\nxfrm async resumption hold skb->dev refcnt until after transport_finish.\nHowever, xfrm_rcv_cb may modify skb->dev to tunnel dev without taking\ndevice reference, such as vti_rcv_cb. The subsequent async resumption\nwill decrement the tunnel device's reference count, which lead to uaf\nof tunnel dev and refcnt leak of orig dev as below:\n\nunregister_netdevice: waiting for vti1 to become free. Usage count = -2\n\nStash the original skb->dev to fix refcnt imbalance. The new skb->dev set\nby xfrm_rcv_cb can race with device teardown. Extend rcu protection over\nxfrm_rcv_cb and transport_finish to prevent races.","published":"2026-08-15T05:57:07.413Z","modified":"2026-08-18T03:56:25.620474769Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"Linux","name":"Kernel","fixedVersion":"7.1.5"}],"fix":null,"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/63a30015199912bd5055bead8001b1ae68a67cdb"},{"type":"WEB","url":"https://git.kernel.org/stable/c/8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72463.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-72463"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-18T03:56:25.620474769Z"}}