CVE-2026-72463

A flaw was found in the Linux kernel's xfrm (IP eXtensible FRamework for IPsec) subsystem. This vulnerability occurs during asynchronous resumption where the xfrm_rcv_cb function can modify a network device without properly managing its reference count. This improper handling leads to a use-after-free condition on the tunnel device and a reference count leak on the original device. An attacker could potentially exploit this to cause system instability or a denial of service (DoS).

This vulnerability is rated as Important rather than Moderate because a local user could exploit memory corruption triggered by an asynchronous IPsec packet processing flaw to compromise system integrity or execute arbitrary code within kernel space. The issue stems from reference count mismanagement when handling tunnel interface callbacks during packet reception, leading to premature freeing of network device structures. Red Hat Enterprise Linux kernels are not vulnerable to this flaw because the underlying code changes introduced upstream were not incorporated into supported product streams.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.