CVE-2026-63919 (GCVE-0-2026-63919)
Vulnerability from cvelistv5
Published
2026-07-19 14:55
Modified
2026-08-05 12:37
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: xfrm: input: hold netns during deferred transport reinjection Transport-mode reinjection stores a struct net pointer in skb->cb and uses it later from xfrm_trans_reinject(). That pointer must stay valid until the deferred callback runs. Take a netns reference when queueing deferred reinjection work and drop it after the callback completes. Use maybe_get_net() so the queueing path does not revive a namespace that is already being torn down. This keeps the existing workqueue design and fixes the netns lifetime handling in one place for all users of xfrm_trans_queue_net().
References
Impacted products
Vendor Product Version
Linux Linux Version: 7b3801927e52f8621de311277f7fc727635019e7
Version: 7b3801927e52f8621de311277f7fc727635019e7
Version: 7b3801927e52f8621de311277f7fc727635019e7
Version: 7b3801927e52f8621de311277f7fc727635019e7
Version: 7b3801927e52f8621de311277f7fc727635019e7
Version: 7b3801927e52f8621de311277f7fc727635019e7
Version: 7b3801927e52f8621de311277f7fc727635019e7
Version: 7b3801927e52f8621de311277f7fc727635019e7
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/xfrm/xfrm_input.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7ee59eda8820b758ed29e1cd3222359c7b97302c",
              "status": "affected",
              "version": "7b3801927e52f8621de311277f7fc727635019e7",
              "versionType": "git"
            },
            {
              "lessThan": "2df7059a18afb7d3aee6c36cad5d371c198111d4",
              "status": "affected",
              "version": "7b3801927e52f8621de311277f7fc727635019e7",
              "versionType": "git"
            },
            {
              "lessThan": "8dfabcba6a943a7a02ebe1e1637c361ba96acbaa",
              "status": "affected",
              "version": "7b3801927e52f8621de311277f7fc727635019e7",
              "versionType": "git"
            },
            {
              "lessThan": "48ce101cd630d6745b6923b5bad8358bc4c119da",
              "status": "affected",
              "version": "7b3801927e52f8621de311277f7fc727635019e7",
              "versionType": "git"
            },
            {
              "lessThan": "55ddfc41451f01c588089cd74957a05311b6f202",
              "status": "affected",
              "version": "7b3801927e52f8621de311277f7fc727635019e7",
              "versionType": "git"
            },
            {
              "lessThan": "9f7ebb45a83afc3216e855e57d51bb4bc9b5232e",
              "status": "affected",
              "version": "7b3801927e52f8621de311277f7fc727635019e7",
              "versionType": "git"
            },
            {
              "lessThan": "9f67a36e91bb50d358760f381f233913fe5c09f8",
              "status": "affected",
              "version": "7b3801927e52f8621de311277f7fc727635019e7",
              "versionType": "git"
            },
            {
              "lessThan": "c16f74dc1d75d0e2e7670076d5375deda110ebeb",
              "status": "affected",
              "version": "7b3801927e52f8621de311277f7fc727635019e7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/xfrm/xfrm_input.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: input: hold netns during deferred transport reinjection\n\nTransport-mode reinjection stores a struct net pointer in skb-\u003ecb and\nuses it later from xfrm_trans_reinject(). That pointer must stay valid\nuntil the deferred callback runs.\n\nTake a netns reference when queueing deferred reinjection work and drop\nit after the callback completes. Use maybe_get_net() so the queueing\npath does not revive a namespace that is already being torn down.\n\nThis keeps the existing workqueue design and fixes the netns lifetime\nhandling in one place for all users of xfrm_trans_queue_net()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable path is reached when IPsec ESP/AH packets are received and processed through xfrm_input transport-mode reinjection, which is a network packet receive path in net/xfrm. Remote peers can send ESP traffic to trigger deferred queueing on systems with IPsec configured.\nAC:L - The attacker controls both sides of the race by flooding IPsec packets to queue deferred reinjection work while concurrently destroying the network namespace, making the UAF reliably triggerable without conditions outside attacker control.\nPR:L - Exploitation requires configuring xfrm/IPsec and managing network namespace lifecycle, both reachable with CAP_NET_ADMIN obtainable by an unprivileged user via user namespaces (unshare -Urn), not requiring real root in the init namespace.\nUI:N - No victim user interaction is required; exploitation is achieved through automated packet transmission and namespace teardown scripted by the attacker.\nS:U - Impact is kernel memory corruption and potential privilege escalation within the same security authority; this is not a VM escape or cross-authority boundary bypass.\nC:H - The deferred callback dereferences a freed struct net (e.g., ip6_rcv_finish_core reads sysctl fields from the UAF pointer), providing an information disclosure primitive from attacker-influenced freed slab memory.\nI:H - Use-after-free on the large struct net slab object enables heap grooming and memory corruption exploitable for arbitrary kernel writes and control-flow hijacking, not merely a bounded modification.\nA:H - Dereferencing a freed network namespace structure causes kernel oops/panic from the workqueue callback path, and UAF reliably threatens system availability even when full exploitation is not attempted."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:37:13.727Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7ee59eda8820b758ed29e1cd3222359c7b97302c"
        },
        {
          "url": "https://git.kernel.org/stable/c/2df7059a18afb7d3aee6c36cad5d371c198111d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/8dfabcba6a943a7a02ebe1e1637c361ba96acbaa"
        },
        {
          "url": "https://git.kernel.org/stable/c/48ce101cd630d6745b6923b5bad8358bc4c119da"
        },
        {
          "url": "https://git.kernel.org/stable/c/55ddfc41451f01c588089cd74957a05311b6f202"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f7ebb45a83afc3216e855e57d51bb4bc9b5232e"
        },
        {
          "url": "https://git.kernel.org/stable/c/9f67a36e91bb50d358760f381f233913fe5c09f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/c16f74dc1d75d0e2e7670076d5375deda110ebeb"
        }
      ],
      "title": "xfrm: input: hold netns during deferred transport reinjection",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-63919",
    "datePublished": "2026-07-19T14:55:22.121Z",
    "dateReserved": "2026-07-19T07:54:57.020Z",
    "dateUpdated": "2026-08-05T12:37:13.727Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.