What is the CVSS score of CVE-2026-72451?

CVE-2026-72451 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-72451?

A race condition in the Linux kernel's IPsec encryption stack could enable attackers to trigger denial-of-service events on VPN systems and network security gateways, potentially disrupting secure…. A patch is available.

How to fix or mitigate CVE-2026-72451?

Within 24 hours, audit your Linux systems inventory to identify all hosts with IPsec/xfrm enabled, prioritizing VPN concentrators, SD-WAN appliances, and network security devices; cross-reference installed kernel versions against vendor security advisories to confirm exposure. Over the next 7 days, obtain the vendor-released patch, test it in a staging environment that mirrors your production IPsec configurations, and validate that dependent services (VPN clients, routing protocols, encryption tunnels) continue functioning normally. Complete patched kernel deployment across all affected systems by day 30, coordinating reboots during change-control windows and prioritizing production infrastructure.

Linux Kernel CVE-2026-72451

EUVD-2026-59350 CRITICAL

2026-08-15 Linux

GHSA-pw2h-mp67-xjw4

Denial Of Service Linux Red Hat Suse

Critical

Disputed · 9.8 Vendor: Linux

Severity by source

Sources disagree (Medium–Critical)

Vendor (Linux) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

4.7 MEDIUM

Winning a narrow TOCTOU race while killing an xfrm state needs local CAP_NET_ADMIN control, so AV:L/AC:H/PR:L; realistic impact is a kernel crash (A:H) not confidentiality/integrity loss.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Red Hat

7.0 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 09:30 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

9.8 (CRITICAL)

Patch available

Aug 15, 2026 - 07:20 EUVD

CVE Published

Aug 15, 2026 - 05:56 cve.org

CRITICAL 9.8

CVE Published

Aug 15, 2026 - 05:56 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

xfrm: Fix xfrm state cache insertion race

The xfrm input state cache insertion code checks the validity of the state before acquiring the global xfrm_state_lock. Thus it's possible for someone else to kill the state after it passed the validity check, and then the insertion will add the dead state to the cache.

Fix this by moving the validity check inside the lock.

This entire function is called on the input path, where BH must be off (e.g., the caller of this function xfrm_input acquires its spinlocks without disabling BH).

So there is no need to disable BH here or take the RCU read lock. Remove both and replace them with an assertion that trips if BH is accidentally enabled on some future calling path.

AnalysisAI

Denial-of-service (and potential use-after-free) in the Linux kernel's xfrm/IPsec state-cache logic lets a stale state be inserted into the input-path cache because the state's validity is checked before the global xfrm_state_lock is taken. In the window between the check and the lock, a concurrent operation can kill the state, so a dead (freed-path) state gets cached and later dereferenced on the IPsec input path. Despite an auto-generated 9.8 CVSS, real-world signals are modest: EPSS is 0.21% (11th percentile), the issue is tagged Denial of Service, it is not in CISA KEV, and no public exploit was identified at time of analysis.

Technical ContextAI

The affected component is the kernel's XFRM framework, the transformation layer that implements IPsec (ESP/AH) state handling. On the packet input path, xfrm_input performs a fast-path state-cache insertion; the buggy code validated the xfrm_state object (checking it is still alive/valid) before acquiring the global xfrm_state_lock, creating a classic time-of-check/time-of-use race (CWE-362) that can lead to using a freed or dead object (CWE-416) - the upstream CWE field is unpopulated (N/A). The fix moves the validity check inside the lock and, because xfrm_input already runs with bottom halves disabled, removes the now-redundant local BH-disable and RCU read lock, replacing them with an assertion that fires if BH is unexpectedly enabled on a future call path. CPE data identifies the affected product generically as cpe:2.3:a:linux:linux (the Linux kernel); only kernels using the xfrm/IPsec subsystem are meaningfully exposed.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.12.97 or later on the 6.12.x branch, 6.18.40 or later, or your distribution's build incorporating the corresponding fix commits (git.kernel.org/stable/c/6dab4dec9a49121d079981ac913569f232c06b06 and the sibling commits ddd3d0132920, 041859fd55c8, a1a3360a0c44). Apply the vendor kernel package from your distribution and reboot, since this is a core in-kernel fix with no runtime toggle. Where immediate patching is not possible on systems that do not require IPsec, a concrete compensating control is to not load/use the xfrm data path - e.g. avoid configuring IPsec SAs and restrict who holds CAP_NET_ADMIN so untrusted local users cannot rapidly create/delete xfrm states to drive the race (trade-off: this does nothing for hosts that legitimately terminate IPsec/VPN tunnels, which remain exposed until patched). Do not rely on network filtering alone, as the race is in state management rather than a specific packet signature.

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-72451 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-72451

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Denial Of Service

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code