Skip to main content

Linux Kernel CVE-2026-72463

| EUVDEUVD-2026-59362 CRITICAL
2026-08-15 Linux GHSA-23r2-6gqr-3m38
Information Disclosure Linux Red Hat Suse
9.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Triggered by network IPsec packets (AV:N) but requires winning a teardown race on a VTI-configured host (AC:H); impact is primarily device UAF/DoS (A:H) with limited memory-disclosure/corruption potential (C:L/I:L).

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
6.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Red Hat
7.0 HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 09:36 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
9.8 (CRITICAL)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 05:57 cve.org
CRITICAL 9.8
CVE Published
Aug 15, 2026 - 05:57 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

xfrm: Fix dev use-after-free in xfrm async resumption

xfrm async resumption hold skb->dev refcnt until after transport_finish. However, xfrm_rcv_cb may modify skb->dev to tunnel dev without taking device reference, such as vti_rcv_cb. The subsequent async resumption will decrement the tunnel device's reference count, which lead to uaf of tunnel dev and refcnt leak of orig dev as below:

unregister_netdevice: waiting for vti1 to become free. Usage count = -2

Stash the original skb->dev to fix refcnt imbalance. The new skb->dev set by xfrm_rcv_cb can race with device teardown. Extend rcu protection over xfrm_rcv_cb and transport_finish to prevent races.

AnalysisAI

Use-after-free and reference-count imbalance in the Linux kernel's IPsec (xfrm) asynchronous resumption path allows a device UAF and refcnt leak when packets are processed through tunnel interfaces such as VTI. During async crypto resumption, xfrm_rcv_cb can reassign skb->dev to a tunnel device without taking a reference, so the later decrement frees the tunnel netdevice while the original device leaks (observable as 'unregister_netdevice: waiting for vti1 to become free. Usage count = -2'). The upstream fix stashes the original skb->dev and extends RCU protection over xfrm_rcv_cb and transport_finish. There is no public exploit identified at time of analysis, and EPSS is low (0.16%, 6th percentile).

Technical ContextAI

The flaw lives in the kernel's xfrm framework, which implements the IPsec transformation stack (ESP/AH, transport and tunnel modes). When a crypto operation is offloaded/deferred, xfrm uses asynchronous resumption and holds a reference to skb->dev until transport_finish completes. The xfrm_rcv_cb callback - used by tunnel receive handlers like vti_rcv_cb for VTI (Virtual Tunnel Interface) devices - can rewrite skb->dev to point at the tunnel device without incrementing that device's refcount. The async path then decrements the (wrong) tunnel device's count, producing a negative usage count on the tunnel dev (a use-after-free, CWE-416) and a leaked reference on the original device. The reassigned skb->dev can also race with concurrent device teardown, so the fix additionally widens the RCU read-side critical section. CPE data identifies the affected product broadly as cpe:2.3:a:linux:linux, i.e. the mainline/stable kernel, with the vulnerable path specific to IPsec tunnel receive processing. Note the CWE field is N/A in the source data; the class is inferred from the description as use-after-free.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 7.1.5 (or 7.2-rc1 for mainline) - or the corresponding fixed point release in your maintained series once your distribution ships the backport, applying the upstream commits at https://git.kernel.org/stable/c/63a30015199912bd5055bead8001b1ae68a67cdb and https://git.kernel.org/stable/c/8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff. Track your distribution's advisory for the exact packaged version, then reboot into the patched kernel. Where immediate patching is not possible, reduce exposure by avoiding or removing VTI/xfrm tunnel interfaces on hosts that do not require them (side effect: breaks any IPsec VTI-based VPN connectivity), and restrict which peers can send IPsec traffic to the host via firewall policy on the ESP/AH and IKE paths (side effect: may block legitimate roaming or dynamic peers). These are mitigations only - the refcnt/RCU fix in the kernel is the sole complete remedy.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2026-72463 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy