What is the CVSS score of EUVD-2026-45692?

EUVD-2026-45692 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by EUVD-2026-45692?

CVE-2026-63919 is a use-after-free vulnerability in Linux kernel IPsec transport-mode processing that can cause host crashes or memory corruption when network namespaces are destroyed.. A patch is available.

How to fix or mitigate EUVD-2026-45692?

Within 24 hours, identify all Linux systems running vulnerable kernel versions (5.6 through latest affected) with IPsec transport-mode configured, particularly those in container or virtualized environments where namespace operations occur. Within 7 days, deploy the vendor-released stable kernel patch to all identified systems and perform staged reboots during maintenance windows. Within 30 days, complete post-patch validation that IPsec transport-mode traffic processes normally and systems remain stable across namespace lifecycle events.

Linux Kernel EUVD-2026-45692

| CVE-2026-63919 HIGH

2026-07-19 Linux

GHSA-c9j4-h9xp-p2mj

Linux Code Injection

8.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

7.0 HIGH

Namespace-teardown race needs local CAP_NET_ADMIN-level access to configure xfrm and destroy netns (PR:L, AV:L) and is timing-dependent (AC:H); UAF can yield full memory-corruption impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

HIGH

qualitative

Red Hat

7.0 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 16:19 vuln.today

CVSS changed

Jul 20, 2026 - 15:22 NVD

8.8 (HIGH)

Patch available

Jul 19, 2026 - 17:19 EUVD

CVE Published

Jul 19, 2026 - 14:55 cve.org

HIGH 8.8

CVE Published

Jul 19, 2026 - 14:55 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

xfrm: input: hold netns during deferred transport reinjection

Transport-mode reinjection stores a struct net pointer in skb->cb and uses it later from xfrm_trans_reinject(). That pointer must stay valid until the deferred callback runs.

Take a netns reference when queueing deferred reinjection work and drop it after the callback completes. Use maybe_get_net() so the queueing path does not revive a namespace that is already being torn down.

This keeps the existing workqueue design and fixes the netns lifetime handling in one place for all users of xfrm_trans_queue_net().

AnalysisAI

Use-after-free in the Linux kernel IPsec transport-mode input path (xfrm) allows a struct net pointer cached in skb->cb to be dereferenced after the associated network namespace has been torn down, because deferred reinjection via xfrm_trans_reinject() did not hold a netns reference. On affected kernels (5.6 through the fixed stable releases) this can corrupt kernel memory or crash the host when IPsec transport-mode traffic is processed during namespace destruction. No public exploit identified at time of analysis; EPSS is low (0.23%, 13th percentile) and the issue is not listed in CISA KEV.

Technical ContextAI

The bug lives in the kernel's xfrm (IP transformation / IPsec) input processing. For transport-mode packets that must be reinjected asynchronously, the code stashes a pointer to the packet's owning network namespace (struct net) inside the socket buffer control block (skb->cb) and consumes it later from a workqueue callback, xfrm_trans_reinject(), scheduled through xfrm_trans_queue_net(). If the namespace is destroyed between queueing and callback execution, the deferred worker dereferences freed memory - a classic use-after-free (CWE-416), despite the tag source labelling this 'Code Injection' (a mislabel). CPE data scopes this to cpe:2.3:a:linux:linux, i.e. the mainline/stable kernel itself. The fix takes a namespace reference with maybe_get_net() at queue time - deliberately avoiding reviving a namespace already being torn down - and drops it after the callback, correcting the object lifetime for all users of the deferred reinjection path.

RemediationAI

Vendor-released patch: update to a fixed stable kernel for your branch - 5.10.259, 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, or 7.1 or later - or apply the corresponding git.kernel.org stable commit (base commit 2df7059a18afb7d3aee6c36cad5d371c198111d4 and its per-branch backports). Reboot into the patched kernel or use live-patching where available. If patching must be deferred, reduce exposure by restricting who can drive the vulnerable path: avoid granting CAP_NET_ADMIN to untrusted workloads/containers (this limits an actor's ability to create and rapidly tear down network namespaces and to configure xfrm state, at the cost of blocking legitimate in-container network administration), and disable IPsec transport-mode processing where it is not required (e.g. do not load/enable xfrm/ESP for tenants that do not need it), accepting loss of host-terminated IPsec for those workloads. These are mitigations only; the upstream commit is the actual fix. Track vendor advisories via the kernel.org commits and https://nvd.nist.gov/vuln/detail/CVE-2026-63919.

Same technique Code Injection

View all

CVE-2023-3519 CRITICAL POC

9.8

CVE-2021-22205 CRITICAL POC

10.0

CVE-2024-23692 CRITICAL POC

9.8

CVE-2012-0158 HIGH POC

8.8

CVE-2021-44529 CRITICAL POC

9.8

CVE-2014-6287 CRITICAL POC

9.8

CVE-2017-7494 CRITICAL POC

9.8

CVE-2025-24893 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

EUVD-2026-45692 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-45692

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Code Injection

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code