CVE-2026-72451

A flaw was found in the Linux kernel's xfrm (IPSec framework) component. A race condition exists in the xfrm state cache insertion logic. This occurs because the validity of a state is checked before a global lock is acquired, allowing another process to invalidate the state before it is added to the cache. Consequently, a 'dead' or invalid state can be inserted into the cache, potentially leading to incorrect state management and unexpected system behavior.

Red Hat has classified this vulnerability as having a Moderate impact because successfully exploiting the race condition in the IPsec transformation framework requires precise timing during local concurrent operations, making reliable exploitation difficult. Additionally, the regression is isolated to newer upstream kernel versions and the vulnerable code is not present in supported Red Hat Enterprise Linux releases. Consequently, standard production environments are not exposed to this flaw under default configurations.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.