CVE-2026-72451xfrm: Fix xfrm state cache insertion race
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix xfrm state cache insertion race The xfrm input state cache insertion code checks the validity of the state before acquiring the global xfrm_state_lock. Thus it's possible for someone else to kill the state after it passed the validity check, and then the insertion will add the dead state to the cache. Fix this by moving the validity check inside the lock. This entire function is called on the input path, where BH must be off (e.g., the caller of this function xfrm_input acquires its spinlocks without disabling BH). So there is no need to disable BH here or take the RCU read lock. Remove both and replace them with an assertion that trips if BH is accidentally enabled on some future calling path.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Aug 17, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 5e4334dc39443645415450163ff5ff1ee7e79784 before 6dab4dec9a49121d079981ac913569f232c06b06; from 81a331a0e72ddc2f75092603d9577bd1a0ca23ad before a1a3360a0c44b8b5c134db2a9d0667b61c9cf523; from 81a331a0e72ddc2f75092603d9577bd1a0ca23ad before 041859fd55c81ea55e76d051e39b7b79975b8c7d; from 81a331a0e72ddc2f75092603d9577bd1a0ca23ad before ddd3d0132920319ac426e12456013eadbae67e15; from 6.12.13 before 6.12.97 | CNA record |
References
- https://git.kernel.org/stable/c/6dab4dec9a49121d079981ac913569f232c06b06
- https://git.kernel.org/stable/c/a1a3360a0c44b8b5c134db2a9d0667b61c9cf523
- https://git.kernel.org/stable/c/041859fd55c81ea55e76d051e39b7b79975b8c7d
- https://git.kernel.org/stable/c/ddd3d0132920319ac426e12456013eadbae67e15
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.