https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 21:03:22 +0000 https://vulnerability.circl.lu/vuln/cve-2026-72463 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>xfrm: Fix dev use-after-free in xfrm async resumption</p> <p>xfrm async resumption hold skb-&gt;dev refcnt until after transport_finish. However, xfrm_rcv_cb may modify skb-&gt;dev to tunnel dev without taking device reference, such as vti_rcv_cb. The subsequent async resumption will decrement the tunnel device&#39;s reference count, which lead to uaf of tunnel dev and refcnt leak of orig dev as below:</p> <p>unregister_netdevice: waiting for vti1 to become free. Usage count = -2</p> <p>Stash the original skb-&gt;dev to fix refcnt imbalance. The new skb-&gt;dev set by xfrm_rcv_cb can race with device teardown. Extend rcu protection over xfrm_rcv_cb and transport_finish to prevent races.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>xfrm: Fix dev use-after-free in xfrm async resumption</p> <p>xfrm async resumption hold skb-&gt;dev refcnt until after transport_finish. However, xfrm_rcv_cb may modify skb-&gt;dev to tunnel dev without taking device reference, such as vti_rcv_cb. The subsequent async resumption will decrement the tunnel device&#39;s reference count, which lead to uaf of tunnel dev and refcnt leak of orig dev as below:</p> <p>unregister_netdevice: waiting for vti1 to become free. Usage count = -2</p> <p>Stash the original skb-&gt;dev to fix refcnt imbalance. The new skb-&gt;dev set by xfrm_rcv_cb can race with device teardown. Extend rcu protection over xfrm_rcv_cb and transport_finish to prevent races.</p> https://vulnerability.circl.lu/vuln/cve-2026-72463