CVE-2026-63919

A flaw was found in the Linux kernel's xfrm input component. The transport-mode reinjection process, which handles network packet re-injection, stores a network namespace pointer that must remain valid until a deferred callback completes. However, a missing reference count for the network namespace during this deferred operation could lead to a use-after-free vulnerability. This could allow an attacker to potentially cause a system crash or other unpredictable behavior if the network namespace is deallocated prematurely.

This vulnerability is rated as Moderate severity for Red Hat Enterprise Linux because exploitation requires local access and precise timing to trigger a race condition during network namespace termination. The flaw stems from improper reference counting during deferred IPsec packet processing, which can allow an authenticated local user to cause a kernel crash or memory corruption. The high execution complexity and reliance on concurrent namespace destruction prevent reliable remote exploitation. Older releases such as Red Hat Enterprise Linux 7 are not affected as the relevant subsystem changes were introduced in later kernel baselines.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.