CVE-2026-64581

A flaw was found in the Linux kernel's XFRM (IPSec framework) component. A race condition exists in the xfrm_user_policy() function when clearing the socket destination cache. This allows an unprivileged user, operating within a user and network namespace, to trigger a double-free vulnerability. This can lead to memory corruption, potentially enabling a local attacker to escalate privileges or cause a denial of service.

A race in xfrm_user_policy can double release the socket dst cache because __sk_dst_reset clears sk_dst_cache non atomically while the connected UDP transmit path may concurrently reset the same cache with an atomic xchg. Both racing paths can observe the same old dst and call dst_release on the single socket reference, freeing the xfrm_dst bundle while it is still referenced and creating a use-after-free condition. For the CVSS the PR:L is used because triggering is reported to be reachable by an unprivileged local user through user and network namespaces, but it still requires local code execution on the target. The issue is not directly network reachable as a remote packet only attack. Impact is at least a local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to kernel memory corruption, so it should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.