CVE-2026-64580

A flaw was found in the Linux kernel's xfrm6 component, which manages the IPv6 transformation framework. An error in the xfrm6_fill_dst() function can cause a network device reference to be released twice. This double release leads to a reference count underflow, which may result in resource mismanagement and a denial of service (DoS) condition, making the affected system or network service unavailable.

xfrm6_fill_dst can release a net_device reference on an error path but leave dst.dev pointing to the same device. A later dst_destroy can call netdev_put again on that stale dst.dev value, causing a double reference release and net_device refcount corruption. This is reachable from local IPv6 output paths such as udpv6_sendmsg when XFRM policy and device state hit the in6_dev_get failure path. For the CVSS the PR:L is used for the paranoid score because a local unprivileged process may be able to trigger packet output when the XFRM configuration already exists, even though creating or changing XFRM policy normally requires administrative privileges. The issue is not directly network reachable by incoming packet traffic. Impact is at least local denial of service via ref_tracker warnings, unregister_netdevice stalls, or kernel instability. In the worst defensible case, the double reference release is a memory lifetime bug and may allow broader confidentiality or integrity impact if it can be shaped into a use-after-free.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.