xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
Products / packages Linux · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support · 19 more
Published
Severity and exploitation
KEV coverage does not rule out exploitation.
Assessment vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HAssessment vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HSeverity
high7.8CVSS measures technical severity, not the likelihood of an attack.
Known exploitation
Not listed in the checked CISA KEV catalog
Absence from CISA KEV does not rule out attacks.
Public exploit
Not established by this record
Missing evidence does not mean no public exploit exists.
Remediation
Source guidance available
Review the recorded instructions. Guidance may be a workaround rather than a fixed version.
What this means
In the Linux kernel, the following vulnerability has been resolved:
Source excerpt · LinuxAttack conditions
No attack-condition excerpt has been identified here. Review the full source description and references for authentication, network access, and configuration requirements.
Review supporting sources →Affected versions
Check the exact model, release, and any platform requirements against your installation.
Linux · Linux
Linux
8 ranges
Linux · Linux
Linux
Compare with this publisher’s ranges. This does not inspect your installation.
affected
7b4dc3600e4877178ba94c7fbf7e520421378aa6 → before 6b4dc3181b4bfc5f5fc33ab33b1dc6e15759f4b6
git versions
7b4dc3600e4877178ba94c7fbf7e520421378aa6 → before 3943fcad7694a7d0b15aeabe7d3cc2a2eb8e92e8
git versions
7b4dc3600e4877178ba94c7fbf7e520421378aa6 → before 2c617848ae6e4f07a3e397f604208c293bbecacc
git versions
7b4dc3600e4877178ba94c7fbf7e520421378aa6 → before b4a53add2fa8f1b5aa17d4c5686c320785fab182
git versions
7b4dc3600e4877178ba94c7fbf7e520421378aa6 → before 26edb0a3c99f9d958c212be68b21f1221614dcf0
git versions
7b4dc3600e4877178ba94c7fbf7e520421378aa6 → before 4980162de555cb838f1a189ce7d2cbf5d2e7b050
git versions
7b4dc3600e4877178ba94c7fbf7e520421378aa6 → before a2e2d08fb070fab4947447171f1c4e3ca5a188e5
git versions
7b4dc3600e4877178ba94c7fbf7e520421378aa6 → before 14acf9652e5690de3c7486c6db5fb8dafd0a32a3
git versions
Other versions: unaffected
Linux · Linux
Linux
10 ranges
Linux · Linux
Linux
Compare with this publisher’s ranges. This does not inspect your installation.
affected
2.6.19
unaffected
0 → before 2.6.19
semver versions
5.10.261 → through 5.10.*
semver versions
5.15.210 → through 5.15.*
semver versions
6.1.176 → through 6.1.*
semver versions
6.6.140 → through 6.6.*
semver versions
6.12.88 → through 6.12.*
semver versions
6.18.30 → through 6.18.*
semver versions
7.0.7 → through 7.0.*
semver versions
7.1 → through *
original_commit_for_fix versions
Other versions: affected
Red Hat · redhat-SADP
Red Hat Enterprise Linux 10
1 range
Red Hat · redhat-SADP
Red Hat Enterprise Linux 10
Compare with this publisher’s ranges. This does not inspect your installation.
unaffected
0:6.12.0-211.37.1.el10_2 → before *
rpm versions
Other versions: affected
Product identifiers (CPE)
cpe:/o:redhat:enterprise_linux:10.2Red Hat · redhat-SADP
Red Hat Enterprise Linux 10
0 ranges
Red Hat · redhat-SADP
Red Hat Enterprise Linux 10
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: unaffected
Product identifiers (CPE)
cpe:/o:redhat:enterprise_linux:10.2Red Hat · redhat-SADP
Red Hat Enterprise Linux 10.0 Extended Update Support
1 range
Red Hat · redhat-SADP
Red Hat Enterprise Linux 10.0 Extended Update Support
Compare with this publisher’s ranges. This does not inspect your installation.
unaffected
0:6.12.0-55.88.1.el10_0 → before *
rpm versions
Other versions: affected
Product identifiers (CPE)
cpe:/o:redhat:enterprise_linux_eus:10.0Red Hat · redhat-SADP
Red Hat Enterprise Linux 7 Extended Lifecycle Support
1 range
Red Hat · redhat-SADP
Red Hat Enterprise Linux 7 Extended Lifecycle Support
Compare with this publisher’s ranges. This does not inspect your installation.
unaffected
0:3.10.0-1160.156.1.rt56.1308.el7 → before *
rpm versions
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:rhel_extras_rt_els:7Red Hat · redhat-SADP
Red Hat Enterprise Linux 7 Extended Lifecycle Support
1 range
Red Hat · redhat-SADP
Red Hat Enterprise Linux 7 Extended Lifecycle Support
Compare with this publisher’s ranges. This does not inspect your installation.
unaffected
0:3.10.0-1160.156.1.el7 → before *
rpm versions
Other versions: affected
Product identifiers (CPE)
cpe:/o:redhat:rhel_els:7Red Hat · redhat-SADP
Red Hat Enterprise Linux 8
1 range
Red Hat · redhat-SADP
Red Hat Enterprise Linux 8
Compare with this publisher’s ranges. This does not inspect your installation.
unaffected
0:4.18.0-553.144.1.rt7.485.el8_10 → before *
rpm versions
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:enterprise_linux:8::nfvRed Hat · redhat-SADP
Red Hat Enterprise Linux 8
1 range
Red Hat · redhat-SADP
Red Hat Enterprise Linux 8
Compare with this publisher’s ranges. This does not inspect your installation.
unaffected
0:4.18.0-553.144.1.el8_10 → before *
rpm versions
Other versions: affected
Product identifiers (CPE)
cpe:/o:redhat:enterprise_linux:8Red Hat · redhat-SADP
Red Hat Enterprise Linux 8
0 ranges
Red Hat · redhat-SADP
Red Hat Enterprise Linux 8
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: unaffected
Product identifiers (CPE)
cpe:/o:redhat:enterprise_linux:8Red Hat · redhat-SADP
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
1 range
Red Hat · redhat-SADP
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
Compare with this publisher’s ranges. This does not inspect your installation.
unaffected
0:4.18.0-305.199.1.el8_4 → before *
rpm versions
Other versions: affected
Product identifiers (CPE)
cpe:/o:redhat:rhel_aus:8.4Red Hat · redhat-SADP
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
1 range
Red Hat · redhat-SADP
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
Compare with this publisher’s ranges. This does not inspect your installation.
unaffected
0:4.18.0-305.199.1.el8_4 → before *
rpm versions
Other versions: affected
Product identifiers (CPE)
cpe:/o:redhat:rhel_eus_long_life:8.4Red Hat · redhat-SADP
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
1 range
Red Hat · redhat-SADP
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
Compare with this publisher’s ranges. This does not inspect your installation.
unaffected
0:4.18.0-372.204.1.el8_6 → before *
rpm versions
Other versions: affected
Product identifiers (CPE)
cpe:/o:redhat:rhel_aus:8.6Red Hat · redhat-SADP
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
1 range
Red Hat · redhat-SADP
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
Compare with this publisher’s ranges. This does not inspect your installation.
unaffected
0:4.18.0-372.204.1.el8_6 → before *
rpm versions
Other versions: affected
Product identifiers (CPE)
cpe:/o:redhat:rhel_eus_long_life:8.6Red Hat · redhat-SADP
Red Hat Enterprise Linux 8.8 Telecommunications Update Service
1 range
Red Hat · redhat-SADP
Red Hat Enterprise Linux 8.8 Telecommunications Update Service
Compare with this publisher’s ranges. This does not inspect your installation.
unaffected
0:4.18.0-477.156.1.el8_8 → before *
rpm versions
Other versions: affected
Product identifiers (CPE)
cpe:/o:redhat:rhel_tus:8.8Red Hat · redhat-SADP
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
1 range
Red Hat · redhat-SADP
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
Compare with this publisher’s ranges. This does not inspect your installation.
unaffected
0:4.18.0-477.156.1.el8_8 → before *
rpm versions
Other versions: affected
Product identifiers (CPE)
cpe:/o:redhat:rhel_e4s:8.8Red Hat · redhat-SADP
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
0 ranges
Red Hat · redhat-SADP
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: unaffected
Product identifiers (CPE)
cpe:/o:redhat:rhel_e4s:8.8Red Hat · redhat-SADP
Red Hat Enterprise Linux 9
1 range
Red Hat · redhat-SADP
Red Hat Enterprise Linux 9
Compare with this publisher’s ranges. This does not inspect your installation.
unaffected
0:5.14.0-687.22.1.el9_8 → before *
rpm versions
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:enterprise_linux:9cpe:/o:redhat:enterprise_linux:9Red Hat · redhat-SADP
Red Hat Enterprise Linux 9
0 ranges
Red Hat · redhat-SADP
Red Hat Enterprise Linux 9
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: unaffected
Product identifiers (CPE)
cpe:/o:redhat:enterprise_linux:9Red Hat · redhat-SADP
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
1 range
Red Hat · redhat-SADP
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Compare with this publisher’s ranges. This does not inspect your installation.
unaffected
0:5.14.0-284.183.1.el9_2 → before *
rpm versions
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:rhel_e4s:9.2Red Hat · redhat-SADP
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
1 range
Red Hat · redhat-SADP
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Compare with this publisher’s ranges. This does not inspect your installation.
unaffected
0:5.14.0-284.183.1.rt14.468.el9_2 → before *
rpm versions
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:rhel_e4s:9.2::nfvRed Hat · redhat-SADP
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
0 ranges
Red Hat · redhat-SADP
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: unaffected
Product identifiers (CPE)
cpe:/o:redhat:rhel_e4s:9.2Red Hat · redhat-SADP
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
1 range
Red Hat · redhat-SADP
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
Compare with this publisher’s ranges. This does not inspect your installation.
unaffected
0:5.14.0-427.139.1.el9_4 → before *
rpm versions
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:rhel_e4s:9.4Red Hat · redhat-SADP
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
0 ranges
Red Hat · redhat-SADP
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: unaffected
Product identifiers (CPE)
cpe:/o:redhat:rhel_e4s:9.4Red Hat · redhat-SADP
Red Hat Enterprise Linux 9.6 Extended Update Support
1 range
Red Hat · redhat-SADP
Red Hat Enterprise Linux 9.6 Extended Update Support
Compare with this publisher’s ranges. This does not inspect your installation.
unaffected
0:5.14.0-570.129.1.el9_6 → before *
rpm versions
Other versions: affected
Product identifiers (CPE)
cpe:/a:redhat:rhel_eus:9.6Red Hat · redhat-SADP
Red Hat Enterprise Linux 9.6 Extended Update Support
0 ranges
Red Hat · redhat-SADP
Red Hat Enterprise Linux 9.6 Extended Update Support
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: unaffected
Product identifiers (CPE)
cpe:/o:redhat:rhel_eus:9.6Red Hat · redhat-SADP
Red Hat Enterprise Linux 6
0 ranges
Red Hat · redhat-SADP
Red Hat Enterprise Linux 6
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: unknown
Product identifiers (CPE)
cpe:/o:redhat:enterprise_linux:6Red Hat · redhat-SADP
Red Hat Enterprise Linux 9
0 ranges
Red Hat · redhat-SADP
Red Hat Enterprise Linux 9
Compare with this publisher’s ranges. This does not inspect your installation.
Other versions: affected
Product identifiers (CPE)
cpe:/o:redhat:enterprise_linux:9Siemens · siemens-SADP
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)
1 range
Siemens · siemens-SADP
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)
Compare with this publisher’s ranges. This does not inspect your installation.
affected
V3.1.6 → before *
custom versions
Other versions: unknown
Siemens · siemens-SADP
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)
1 range
Siemens · siemens-SADP
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)
Compare with this publisher’s ranges. This does not inspect your installation.
affected
V3.1.7 → before *
custom versions
Other versions: unknown
Siemens · siemens-SADP
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)
1 range
Siemens · siemens-SADP
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)
Compare with this publisher’s ranges. This does not inspect your installation.
affected
V3.1.6 → before *
custom versions
Other versions: unknown
Siemens · siemens-SADP
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)
1 range
Siemens · siemens-SADP
SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)
Compare with this publisher’s ranges. This does not inspect your installation.
affected
V3.1.7 → before *
custom versions
Other versions: unknown
Siemens · siemens-SADP
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)
1 range
Siemens · siemens-SADP
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)
Compare with this publisher’s ranges. This does not inspect your installation.
affected
V3.1.6 → before *
custom versions
Other versions: unknown
Siemens · siemens-SADP
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)
1 range
Siemens · siemens-SADP
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)
Compare with this publisher’s ranges. This does not inspect your installation.
affected
V3.1.7 → before *
custom versions
Other versions: unknown
Siemens · siemens-SADP
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)
1 range
Siemens · siemens-SADP
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)
Compare with this publisher’s ranges. This does not inspect your installation.
affected
V3.1.6 → before *
custom versions
Other versions: unknown
Siemens · siemens-SADP
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)
1 range
Siemens · siemens-SADP
SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)
Compare with this publisher’s ranges. This does not inspect your installation.
affected
V3.1.7 → before *
custom versions
Other versions: unknown
Siemens · siemens-SADP
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
1 range
Siemens · siemens-SADP
SIMATIC S7-1500 TM MFP - GNU/Linux subsystem
Compare with this publisher’s ranges. This does not inspect your installation.
affected
0 → before *
custom versions
Other versions: unknown
Siemens · siemens-SADP
SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)
1 range
Siemens · siemens-SADP
SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)
Compare with this publisher’s ranges. This does not inspect your installation.
affected
V3.1.6 → before *
custom versions
Other versions: unknown
Siemens · siemens-SADP
SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)
1 range
Siemens · siemens-SADP
SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)
Compare with this publisher’s ranges. This does not inspect your installation.
affected
V3.1.7 → before *
custom versions
Other versions: unknown
What to do
Compare your installed product and version with the affected versions above. A matching product name alone does not confirm exposure.
RHSA-2026:41235: Red Hat Enterprise Linux Server (v. 7 ELS), Red Hat Enterprise Linux Server Optional (v. 7 ELS)
RHSA-2026:41234: Red Hat Enterprise Linux for Real Time (v. 7 ELS)
RHSA-2026:39371: Red Hat Enterprise Linux AppStream EUS (v. 10.0), Red Hat Enterprise Linux BaseOS EUS (v. 10.0), Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0), Red Hat Enterprise Linux Real Time EUS (v. 10.0), Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)
RHSA-2026:42919: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Real Time (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10)
RHSA-2026:47739: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux BaseOS E4S (v.9.2)
RHSA-2026:43231: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux BaseOS E4S (v.9.4), Red Hat Enterprise Linux Real Time E4S (v.9.4), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.4)
RHSA-2026:44385: Red Hat CodeReady Linux Builder EUS (v.9.6), Red Hat Enterprise Linux AppStream EUS (v.9.6), Red Hat Enterprise Linux BaseOS EUS (v.9.6), Red Hat Enterprise Linux Real Time EUS (v.9.6), Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)
RHSA-2026:36018: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9)
RHSA-2026:59143: Red Hat Enterprise Linux BaseOS (v. 10)
RHSA-2026:39179: Red Hat Enterprise Linux BaseOS (v. 8), Red Hat Enterprise Linux CRB (v. 8)
RHSA-2026:59146: Red Hat Enterprise Linux BaseOS (v. 8)
RHSA-2026:47633: Red Hat Enterprise Linux BaseOS AUS (v.8.4), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)
RHSA-2026:49033: Red Hat Enterprise Linux BaseOS AUS (v.8.6), Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.6)
RHSA-2026:47869: Red Hat Enterprise Linux BaseOS E4S (v.8.8), Red Hat Enterprise Linux BaseOS TUS (v.8.8)
RHSA-2026:59142: Red Hat Enterprise Linux BaseOS E4S (v.8.8)
RHSA-2026:59147: Red Hat Enterprise Linux BaseOS E4S (v.9.2)
RHSA-2026:59145: Red Hat Enterprise Linux BaseOS E4S (v.9.4)
RHSA-2026:59148: Red Hat Enterprise Linux BaseOS EUS (v.9.6)
RHSA-2026:59149: Red Hat Enterprise Linux BaseOS (v. 9)
RHSA-2026:39180: Red Hat Enterprise Linux NFV (v. 8), Red Hat Enterprise Linux RT (v. 8)
RHSA-2026:47632: Red Hat Enterprise Linux Real Time E4S (v.9.2), Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
cve.new guidance unless attributed to a publisher. This page does not inspect your installation.
Public exploit evidence
No public exploit reference is identified in the imported evidence. This is not a claim that no exploit exists.
Original source description
Read the full publisher description
In the Linux kernel, the following vulnerability has been resolved:
xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete
KASAN reproduces a slab-use-after-free in __xfrm_state_delete()'s hlist_del_rcu calls under syzkaller load on linux-6.12.y stable (reproduced on 6.12.47, also reachable via the same code path on torvalds/master and on the ipsec tree). Nine unique signatures cluster in the xfrm_state lifecycle, the load-bearing one being:
BUG: KASAN: slab-use-after-free in __hlist_del include/linux/list.h:990 [inline] BUG: KASAN: slab-use-after-free in hlist_del_rcu include/linux/rculist.h:516 [inline] BUG: KASAN: slab-use-after-free in __xfrm_state_delete net/xfrm/xfrm_state.c Write of size 8 at addr ffff8881198bcb70 by task kworker/u8:9/435
Workqueue: netns cleanup_net Call Trace: __hlist_del / hlist_del_rcu __xfrm_state_delete xfrm_state_delete xfrm_state_flush xfrm_state_fini ops_exit_list cleanup_net
The other observed signatures hit the same slab object from __xfrm_state_lookup, xfrm_alloc_spi, __xfrm_state_insert and an OOB write variant of __xfrm_state_delete, all on the byseq/byspi hash chains.
__xfrm_state_delete() guards its byseq and byspi unhashes with value-based predicates:
if (x->km.seq)
hlist_del_rcu(&x->byseq);
if (x->id.spi)
hlist_del_rcu(&x->byspi);
while everywhere else in the file (e.g. state_cache, state_cache_input) the safer hlist_unhashed() check is used. xfrm_alloc_spi() sets x->id.spi = newspi inside xfrm_state_lock and then immediately inserts into byspi, but a path that observes x->id.spi != 0 outside of xfrm_state_lock can still skip-or-hit the byspi unhash inconsistently with whether x is actually on the list. The same holds for x->km.seq versus byseq, and the bydst/bysrc unhashes have no predicate at all, so a second __xfrm_state_delete() on the same object writes through LIST_POISON pprev.
The defensive change here:
- Use hlist_del_init_rcu() instead of hlist_del_rcu() on bydst, bysrc, byseq and byspi so a second deletion is a no-op rather than a write through LIST_POISON pprev. The byseq/byspi nodes are already initialised in xfrm_state_alloc().
- Test hlist_unhashed() rather than the value predicate for byseq/byspi, so the unhash decision tracks list state rather than mutable scalar fields.
Empirical verification: applied this patch on top of v6.12.47, rebuilt, and re-ran the same syzkaller harness for 1h16m on a previously-crashy configuration that produced ~100 hits each of slab-use-after-free Read in xfrm_alloc_spi / Read in __xfrm_state_lookup / Write in __xfrm_state_delete. After the patch, 7.1M execs across 32 VMs at ~1550 exec/sec produced zero xfrm_state UAF/OOB hits. /proc/slabinfo confirms the xfrm_state slab is actively allocated and freed during the run (~143 KiB resident), so the fuzzer is still exercising those code paths -- they just no longer crash.
Reproduction:
- Linux 6.12.47 x86_64 + KASAN_GENERIC + KASAN_INLINE + KCOV
- syzkaller @ 746545b8b1e4c3a128db8652b340d3df90ce61db
- 32 QEMU/KVM VMs x 2 vCPU on AWS c5.metal bare metal
- 9 unique signatures collected in ~9h, all within xfrm_state lifecycle
References
35 sourcesView 29 more references
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-46116View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Environment requirements
These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.
Linux · platform conditions
Any condition may hold
Vulnerable product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*From (inclusive): 2.6.19
Before: 5.10.261
Vulnerable product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*From (inclusive): 2.6.19
Before: 5.15.210
Vulnerable product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*From (inclusive): 2.6.19
Before: 6.1.176
Vulnerable product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*From (inclusive): 2.6.19
Before: 6.6.140
Vulnerable product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*From (inclusive): 2.6.19
Before: 6.12.88
Vulnerable product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*From (inclusive): 2.6.19
Before: 6.18.30
Vulnerable product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*From (inclusive): 2.6.19
Before: 7.0.7
Vulnerable product
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*From (inclusive): 2.6.19
Before: 7.1
Applicability preview
[
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.19",
"versionEndExcluding": "5.10.261"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.19",
"versionEndExcluding": "5.15.210"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.19",
"versionEndExcluding": "6.1.176"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.19",
"versionEndExcluding": "6.6.140"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.19",
"versionEndExcluding": "6.12.88"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.19",
"versionEndExcluding": "6.18.30"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.19",
"versionEndExcluding": "7.0.7"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "2.6.19",
"versionEndExcluding": "7.1"
}
]
}
]
}
]Contributing organizations · 4
Assigning organization
Additional data publisher
Additional data publisher
Additional data publisher
Timeline
All times UTCAdvisory published
Publication date supplied by the source.
Source updated
Latest modification date supplied by the source.
Last imported by cve.new
Latest catalog import, not the date we first saw this advisory.
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.