Linux Kernel EUVD-2026-53274

The Linux kernel's xfrm6 subsystem implements IPv6 IPsec transform policy routing. In xfrm6_fill_dst() (net/ipv6/xfrm6_policy.c), the code acquires a reference to the outbound net_device via in6_dev_get() and, on failure, correctly releases it with netdev_put() but neglects to NULL out xdst->u.dst.dev. When the destination entry is later torn down, dst_destroy() (net/core/dst.c:115) unconditionally calls netdev_put(dst->dev) again - releasing the same reference twice. This underflows the net_device's reference-count tracker (lib/ref_tracker.c), which is precisely the pattern the kernel's ref_tracker was built to detect. The analogous XFRM device-offload paths (xfrm_dev_state_add() and xfrm_dev_policy_add() in net/xfrm/xfrm_device.c) already NULL the ->dev pointer after calling netdev_put() on error; this fix brings xfrm6_fill_dst() into consistency with that established convention. The CPE is cpe:2.3:a:linux:linux and the vulnerability is introduced at commit 84c4a9dfbf430861e7588d95ae3ff61535dca351. No CWE was formally assigned, but the root cause class is a double-release of a counted reference - functionally equivalent to CWE-415 (Double Free) at the kernel refcount layer.