Skip to main content

Linux Kernel CVE-2026-72137

| EUVDEUVD-2026-58895 CRITICAL
2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-w74p-mj9r-98xw
Information Disclosure Linux Red Hat Suse
9.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
4.1 MEDIUM

Enabling XFRM NAT keepalive needs CAP_NET_ADMIN (PR:H) and the double free triggers only on an error/timing-dependent send path (AC:H, AV:L); impact is a kernel crash (A:H).

3.1 AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Red Hat
7.0 HIGH
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 07:11 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
9.8 (CRITICAL)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 06:21 cve.org
CRITICAL 9.8
CVE Published
Aug 15, 2026 - 06:21 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

xfrm: nat_keepalive: avoid double free on send error

nat_keepalive_send() frees the keepalive skb whenever the IPv4 or IPv6 send helper reports an error.

That cleanup is only correct before the skb is handed to the output path. Once ip_build_and_send_pkt() or ip6_xmit() takes ownership, the networking stack may already have consumed the skb before returning an error, so freeing it again is unsafe.

Handle the pre-handoff failure cases inside nat_keepalive_send_ipv4() and nat_keepalive_send_ipv6(), where the caller still owns the skb, and keep nat_keepalive_send() responsible only for family dispatch and the unsupported-family cleanup path.

AnalysisAI

Kernel memory corruption (double free) in the Linux kernel's XFRM/IPsec NAT keepalive path allows a crash or potential heap exploitation when a keepalive transmission fails after the socket buffer has already been handed to the IPv4/IPv6 output stack. Introduced with the nat_keepalive feature in Linux 6.11 and affecting recent stable branches, nat_keepalive_send() incorrectly frees an skb that ip_build_and_send_pkt() or ip6_xmit() may already have consumed, producing a double free. EPSS is low (0.21%, 11th percentile), no public exploit has been identified, and it is not listed in CISA KEV; despite the auto-assigned 9.8 CVSS, realistic impact centers on denial of service and requires an IPsec NAT-traversal configuration.

Technical ContextAI

The flaw lives in the kernel's XFRM (IP transformation) subsystem, specifically the NAT keepalive mechanism used with IPsec NAT traversal (NAT-T) to keep UDP-encapsulated ESP flows alive through NAT devices. The generic dispatcher nat_keepalive_send() called the family-specific helpers and then freed the keepalive skb on any error return. That ownership assumption is wrong once ip_build_and_send_pkt() (IPv4) or ip6_xmit() (IPv6) is invoked, because the output path can consume/free the skb internally and still return an error, leaving the caller to free an already-freed buffer. This is a classic CWE-415 Double Free / use-after-free memory-safety class bug (the input CWE field is N/A, so this is inferred from the description). The fix moves post-handoff error handling into nat_keepalive_send_ipv4()/ipv6() where the caller still owns the skb, leaving nat_keepalive_send() responsible only for family dispatch and the unsupported-family free.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.12.101, 6.18.40, 7.1.5, or 7.2-rc4 (or your distribution's backport referencing these commits). The upstream fixes are at https://git.kernel.org/stable/c/226f4a490d1a938fc838d8f8c46a4eca864c0d78, .../5b0c4c916f202b8fd13d12afb6af62b385622f81, .../a8a7e6a9ff8a4c1f067694ddbd44be67fdf36693, and .../d0a4dc7efa825bce60a8da8f7d43c864a159abde. If you cannot patch immediately and do not require it, avoid the vulnerable code path by not enabling XFRM NAT keepalive on affected hosts (do not configure the nat_keepalive interval on IPsec states), which prevents the buggy send routine from running at the cost of losing automatic NAT-traversal keepalives - remote peers behind NAT may then see IPsec sessions time out and require alternative keepalive handling. Restricting CAP_NET_ADMIN and XFRM configuration to trusted operators further limits who can enable the affected feature.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-72137 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy