CVE-2026-92489

A flaw was found in the Linux kernel's xfrm subsystem. This vulnerability occurs in the xfrm_dev_direct_output() function due to incorrect handling of network packet buffer (skb) ownership. When netfilter drops a packet, the skb can be freed twice, leading to a double-free condition. This memory corruption issue could potentially lead to a denial of service.

A double free in xfrm_dev_direct_output occurs when local_out consumes an skb or transfers its ownership, for example when Netfilter drops the packet, but the XFRM output path calls kfree_skb on the same skb again. This is a kernel memory corruption condition which can cause a crash and may allow confidentiality or integrity impact if an attacker can reliably influence allocator reuse after the double free. For the CVSS the PR:N in the paranoid score reflects an attacker that only needs to send network adjacent traffic through an already configured vulnerable XFRM device offload and Netfilter path. The issue is not generally reachable from the public Internet and depends on a specific IPsec XFRM forwarding configuration. Impact is at least denial of service through kernel memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.