CVE-2026-64581 (GCVE-0-2026-64581)

Vulnerability from cvelistv5 – Published: 2026-08-05 08:09 – Updated: 2026-08-05 08:09
VLAI
Title
xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
Summary
In the Linux kernel, the following vulnerability has been resolved: xfrm: fix sk_dst_cache double-free in xfrm_user_policy() xfrm_user_policy() clears the socket dst cache with __sk_dst_reset(), i.e. the non-atomic __sk_dst_set(sk, NULL): it reads sk_dst_cache with rcu_dereference_protected(), stores NULL and dst_release()s the old dst. That is only safe if no other thread modifies sk_dst_cache concurrently. For a connected UDP socket that does not hold: the transmit fast path (udp_sendmsg -> sk_dst_check -> sk_dst_reset) resets the cache locklessly with an atomic xchg(). A per-socket policy change racing a send can make both sides observe the same old dst and each dst_release() it, dropping the socket's single reference twice and freeing the xfrm_dst bundle while it is still referenced: BUG: KASAN: slab-use-after-free in dst_release Write of size 4 at addr ffff88801897b6c0 by task exploit/155 Call Trace: ... dst_release (... ./include/linux/rcuref.h:109) xfrm_user_policy (./include/net/sock.h:2239 ./include/net/sock.h:2256 net/xfrm/xfrm_state.c:3053) do_ip_setsockopt (net/ipv4/ip_sockglue.c:1347) ip_setsockopt (net/ipv4/ip_sockglue.c:1417) do_sock_setsockopt (net/socket.c:2368) __sys_setsockopt (net/socket.c:2393) __x64_sys_setsockopt (net/socket.c:2396) do_syscall_64 (arch/x86/entry/syscall_64.c:94) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) Reachable by an unprivileged user via a user+network namespace. Use the atomic sk_dst_reset() so the cache is cleared and released with a single xchg(): whichever side wins releases the dst once, the other sees NULL and does nothing. Behaviour is otherwise unchanged.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 2b06cdf3e688b98fcc9945873b5d42792bd4eee0 , < 96b678d08268b5f5c6fc99d4289d9b7e334fc683 (git)
Affected: 2b06cdf3e688b98fcc9945873b5d42792bd4eee0 , < c283e9ada7fcb7dd4b10592623086b2e6d2f9925 (git)
Affected: 72f157be2f81910ae759bfe2e5c2256fc4625645 (git)
Affected: 9e9fe58a92a46c6d154d2901735bf230d91b8507 (git)
Affected: adc1ec6cdc20d430aa01b86497220709b9149466 (git)
Affected: b54033eb1cfd77aba471269ddd804ed8d3e35dea (git)
Affected: c9e82cb34c3c2ee895af01bc899c6ed0bc6eb04a (git)
Affected: 5eef9b51114fcc65651d671add52f267f91b9451 (git)
Affected: 3.16.52 , < 3.17 (semver)
Affected: 4.4.163 , < 4.5 (semver)
Affected: 3.18.101 , < 3.19 (semver)
Affected: 4.1.52 , < 4.2 (semver)
Affected: 4.4.123 , < 4.5 (semver)
Affected: 4.9.89 , < 4.10 (semver)
Create a notification for this product.
Linux Linux Affected: 4.14
Unaffected: 0 , < 4.14 (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2-rc4 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/xfrm/xfrm_state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "96b678d08268b5f5c6fc99d4289d9b7e334fc683",
              "status": "affected",
              "version": "2b06cdf3e688b98fcc9945873b5d42792bd4eee0",
              "versionType": "git"
            },
            {
              "lessThan": "c283e9ada7fcb7dd4b10592623086b2e6d2f9925",
              "status": "affected",
              "version": "2b06cdf3e688b98fcc9945873b5d42792bd4eee0",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "72f157be2f81910ae759bfe2e5c2256fc4625645",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9e9fe58a92a46c6d154d2901735bf230d91b8507",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "adc1ec6cdc20d430aa01b86497220709b9149466",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b54033eb1cfd77aba471269ddd804ed8d3e35dea",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c9e82cb34c3c2ee895af01bc899c6ed0bc6eb04a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "5eef9b51114fcc65651d671add52f267f91b9451",
              "versionType": "git"
            },
            {
              "lessThan": "3.17",
              "status": "affected",
              "version": "3.16.52",
              "versionType": "semver"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.163",
              "versionType": "semver"
            },
            {
              "lessThan": "3.19",
              "status": "affected",
              "version": "3.18.101",
              "versionType": "semver"
            },
            {
              "lessThan": "4.2",
              "status": "affected",
              "version": "4.1.52",
              "versionType": "semver"
            },
            {
              "lessThan": "4.5",
              "status": "affected",
              "version": "4.4.123",
              "versionType": "semver"
            },
            {
              "lessThan": "4.10",
              "status": "affected",
              "version": "4.9.89",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/xfrm/xfrm_state.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc4",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.16.52",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.163",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "3.18.101",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.1.52",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.4.123",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.9.89",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: fix sk_dst_cache double-free in xfrm_user_policy()\n\nxfrm_user_policy() clears the socket dst cache with __sk_dst_reset(),\ni.e. the non-atomic __sk_dst_set(sk, NULL): it reads sk_dst_cache with\nrcu_dereference_protected(), stores NULL and dst_release()s the old dst.\nThat is only safe if no other thread modifies sk_dst_cache concurrently.\n\nFor a connected UDP socket that does not hold: the transmit fast path\n(udp_sendmsg -\u003e sk_dst_check -\u003e sk_dst_reset) resets the cache locklessly\nwith an atomic xchg(). A per-socket policy change racing a send can make\nboth sides observe the same old dst and each dst_release() it, dropping\nthe socket\u0027s single reference twice and freeing the xfrm_dst bundle while\nit is still referenced:\n\n  BUG: KASAN: slab-use-after-free in dst_release\n  Write of size 4 at addr ffff88801897b6c0 by task exploit/155\n  Call Trace:\n   ...\n   dst_release (... ./include/linux/rcuref.h:109)\n   xfrm_user_policy (./include/net/sock.h:2239 ./include/net/sock.h:2256 net/xfrm/xfrm_state.c:3053)\n   do_ip_setsockopt (net/ipv4/ip_sockglue.c:1347)\n   ip_setsockopt (net/ipv4/ip_sockglue.c:1417)\n   do_sock_setsockopt (net/socket.c:2368)\n   __sys_setsockopt (net/socket.c:2393)\n   __x64_sys_setsockopt (net/socket.c:2396)\n   do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n\nReachable by an unprivileged user via a user+network namespace.\n\nUse the atomic sk_dst_reset() so the cache is cleared and released with a\nsingle xchg(): whichever side wins releases the dst once, the other sees\nNULL and does nothing. Behaviour is otherwise unchanged."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:09:35.556Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/96b678d08268b5f5c6fc99d4289d9b7e334fc683"
        },
        {
          "url": "https://git.kernel.org/stable/c/c283e9ada7fcb7dd4b10592623086b2e6d2f9925"
        }
      ],
      "title": "xfrm: fix sk_dst_cache double-free in xfrm_user_policy()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64581",
    "datePublished": "2026-08-05T08:09:35.556Z",
    "dateReserved": "2026-07-19T15:36:31.798Z",
    "dateUpdated": "2026-08-05T08:09:35.556Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64581",
      "date": "2026-08-06",
      "epss": "0.00145",
      "percentile": "0.042"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64581\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-05T08:16:38.177\",\"lastModified\":\"2026-08-05T08:16:38.177\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nxfrm: fix sk_dst_cache double-free in xfrm_user_policy()\\n\\nxfrm_user_policy() clears the socket dst cache with __sk_dst_reset(),\\ni.e. the non-atomic __sk_dst_set(sk, NULL): it reads sk_dst_cache with\\nrcu_dereference_protected(), stores NULL and dst_release()s the old dst.\\nThat is only safe if no other thread modifies sk_dst_cache concurrently.\\n\\nFor a connected UDP socket that does not hold: the transmit fast path\\n(udp_sendmsg -\u003e sk_dst_check -\u003e sk_dst_reset) resets the cache locklessly\\nwith an atomic xchg(). A per-socket policy change racing a send can make\\nboth sides observe the same old dst and each dst_release() it, dropping\\nthe socket\u0027s single reference twice and freeing the xfrm_dst bundle while\\nit is still referenced:\\n\\n  BUG: KASAN: slab-use-after-free in dst_release\\n  Write of size 4 at addr ffff88801897b6c0 by task exploit/155\\n  Call Trace:\\n   ...\\n   dst_release (... ./include/linux/rcuref.h:109)\\n   xfrm_user_policy (./include/net/sock.h:2239 ./include/net/sock.h:2256 net/xfrm/xfrm_state.c:3053)\\n   do_ip_setsockopt (net/ipv4/ip_sockglue.c:1347)\\n   ip_setsockopt (net/ipv4/ip_sockglue.c:1417)\\n   do_sock_setsockopt (net/socket.c:2368)\\n   __sys_setsockopt (net/socket.c:2393)\\n   __x64_sys_setsockopt (net/socket.c:2396)\\n   do_syscall_64 (arch/x86/entry/syscall_64.c:94)\\n   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\\n\\nReachable by an unprivileged user via a user+network namespace.\\n\\nUse the atomic sk_dst_reset() so the cache is cleared and released with a\\nsingle xchg(): whichever side wins releases the dst once, the other sees\\nNULL and does nothing. Behaviour is otherwise unchanged.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/xfrm/xfrm_state.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2b06cdf3e688b98fcc9945873b5d42792bd4eee0\",\"lessThan\":\"96b678d08268b5f5c6fc99d4289d9b7e334fc683\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2b06cdf3e688b98fcc9945873b5d42792bd4eee0\",\"lessThan\":\"c283e9ada7fcb7dd4b10592623086b2e6d2f9925\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"72f157be2f81910ae759bfe2e5c2256fc4625645\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9e9fe58a92a46c6d154d2901735bf230d91b8507\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"adc1ec6cdc20d430aa01b86497220709b9149466\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b54033eb1cfd77aba471269ddd804ed8d3e35dea\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c9e82cb34c3c2ee895af01bc899c6ed0bc6eb04a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5eef9b51114fcc65651d671add52f267f91b9451\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"3.16.52\",\"lessThan\":\"3.17\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.4.163\",\"lessThan\":\"4.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"3.18.101\",\"lessThan\":\"3.19\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.1.52\",\"lessThan\":\"4.2\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.4.123\",\"lessThan\":\"4.5\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.9.89\",\"lessThan\":\"4.10\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/xfrm/xfrm_state.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2-rc4\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/96b678d08268b5f5c6fc99d4289d9b7e334fc683\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c283e9ada7fcb7dd4b10592623086b2e6d2f9925\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "suse_vex": {
      "aggregate_severity": "not set",
      "current_release_date": "2026-08-06T01:06:13Z",
      "cve": "CVE-2026-64581",
      "id": "CVE-2026-64581",
      "initial_release_date": "2026-08-06T01:06:13Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64581",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64581.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.