CVE-2026-72137

A flaw was found in the xfrm subsystem of the Linux kernel, specifically within the nat_keepalive component. This vulnerability occurs when the nat_keepalive_send() function attempts to free a network packet buffer (skb) that may have already been freed by the networking stack. This double free can lead to memory corruption, potentially resulting in a denial of service or other unpredictable system behavior.

This issue does not affect the versions of the kernel as shipped with Red Hat Enterprise Linux 6, 7, 8, and 9, as the vulnerable xfrm NAT keepalive code was introduced in Linux 6.11.

A public local privilege-escalation exploit for this vulnerability has been released.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Update to the latest stable kernel version. Fixes are available for versions 6.12.101, 6.18.40, 7.1.5, and 7.2-rc4.