Skip to main content

Linux Kernel CVE-2026-64580

| EUVDEUVD-2026-53274 HIGH
2026-08-05 Linux GHSA-g6rx-f8gv-c53j
Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

AC:H because triggering the NULL return from in6_dev_get() requires race-condition or device-state timing; otherwise AV:L/PR:L and C/I/A:H are accurate for a kernel refcount underflow.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 08, 2026 - 15:32 vuln.today
CVSS changed
Aug 08, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Aug 05, 2026 - 09:01 EUVD
CVE Published
Aug 05, 2026 - 08:09 cve.org
HIGH 7.8
CVE Published
Aug 05, 2026 - 08:09 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()

On the error path where in6_dev_get(dev) returns NULL, xfrm6_fill_dst() releases the device reference with netdev_put() but leaves xdst->u.dst.dev set. dst_destroy() later calls netdev_put(dst->dev) again, so the same net_device reference is released twice, underflowing its refcount (ref_tracker WARNING + "unregister_netdevice: waiting for <dev> to become free").

Clear xdst->u.dst.dev after the netdev_put(), the same way the XFRM device-offload paths xfrm_dev_state_add() and xfrm_dev_policy_add() in net/xfrm/xfrm_device.c NULL ->dev when releasing the reference on error.

ref_tracker: reference already released. ref_tracker: allocated in: xfrm6_fill_dst (net/ipv6/xfrm6_policy.c:86) ... udpv6_sendmsg (net/ipv6/udp.c:1696) ... ref_tracker: freed in: xfrm6_fill_dst (net/ipv6/xfrm6_policy.c:90) ... WARNING: lib/ref_tracker.c:322 at ref_tracker_free+0x58b/0x780 dst_destroy (net/core/dst.c:115) rcu_core handle_softirqs ...

AnalysisAI

Double reference-count release (double netdev_put()) in the Linux kernel's IPv6 XFRM/IPsec policy subsystem allows a local low-privileged user to underflow a net_device refcount, producing kernel ref_tracker warnings and 'unregister_netdevice: waiting for <dev> to become free' hangs that can destabilize or crash the system and potentially enable privilege escalation through kernel memory corruption. The flaw exists in xfrm6_fill_dst() at net/ipv6/xfrm6_policy.c: on the error path where in6_dev_get(dev) returns NULL, netdev_put() is called but xdst->u.dst.dev is not cleared, so dst_destroy() later releases the same reference a second time. No public exploit and no CISA KEV listing have been identified at time of analysis; EPSS is 0.16% (5th percentile), indicating currently low automated exploitation probability.

Technical ContextAI

The Linux kernel's xfrm6 subsystem implements IPv6 IPsec transform policy routing. In xfrm6_fill_dst() (net/ipv6/xfrm6_policy.c), the code acquires a reference to the outbound net_device via in6_dev_get() and, on failure, correctly releases it with netdev_put() but neglects to NULL out xdst->u.dst.dev. When the destination entry is later torn down, dst_destroy() (net/core/dst.c:115) unconditionally calls netdev_put(dst->dev) again - releasing the same reference twice. This underflows the net_device's reference-count tracker (lib/ref_tracker.c), which is precisely the pattern the kernel's ref_tracker was built to detect. The analogous XFRM device-offload paths (xfrm_dev_state_add() and xfrm_dev_policy_add() in net/xfrm/xfrm_device.c) already NULL the ->dev pointer after calling netdev_put() on error; this fix brings xfrm6_fill_dst() into consistency with that established convention. The CPE is cpe:2.3:a:linux:linux and the vulnerability is introduced at commit 84c4a9dfbf430861e7588d95ae3ff61535dca351. No CWE was formally assigned, but the root cause class is a double-release of a counted reference - functionally equivalent to CWE-415 (Double Free) at the kernel refcount layer.

RemediationAI

The primary remediation is upgrading to a patched kernel version: 6.6.148 or later for the 6.6 stable branch, 6.12.101 or later for the 6.12 branch, 6.18.42 or later for the 6.18 branch, 7.1.6 or later for the 7.1 branch, or 7.2-rc4 or later for the 7.2 mainline. Patch commits are available at the kernel stable git repository links in the references. Distribution-specific packages (Debian, Ubuntu, RHEL, SUSE, etc.) should be checked via their respective security advisories for backported fixes to their shipped kernel versions. Where an immediate upgrade is not feasible, reducing the attack surface by disabling IPv6 XFRM/IPsec policies on affected hosts eliminates the vulnerable code path - though this disables IPsec-based VPN functionality and may not be acceptable in all environments. Restricting local shell access for untrusted users reduces exposure to the local (AV:L/PR:L) exploitation requirement. The VulDB advisory at https://vuldb.com/vuln/386142 and EUVD entry EUVD-2026-53274 may provide additional distribution-specific guidance.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected

Share

CVE-2026-64580 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy