PT-2026-61236 · Linux · Linux

CVE-2026-63919 · Publicado 2026-07-19 · Atualizado 2026-07-19

Mitre

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

xfrm: input: hold netns during deferred transport reinjection

Transport-mode reinjection stores a struct net pointer in skb->cb and uses it later from xfrm trans reinject(). That pointer must stay valid until the deferred callback runs.

Take a netns reference when queueing deferred reinjection work and drop it after the callback completes. Use maybe get net() so the queueing path does not revive a namespace that is already being torn down.

This keeps the existing workqueue design and fixes the netns lifetime handling in one place for all users of xfrm trans queue net().

Correção

Identificadores relacionados

CVE-2026-63919

Produtos afetados

Linux

Referências · 9

• https://git.kernel.org/stable/c/7ee59eda8820b758ed29e1cd3222359c7b97302c · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-63919 · Nota de Segurança
• https://git.kernel.org/stable/c/9f7ebb45a83afc3216e855e57d51bb4bc9b5232e · Nota
• https://git.kernel.org/stable/c/48ce101cd630d6745b6923b5bad8358bc4c119da · Nota
• https://git.kernel.org/stable/c/c16f74dc1d75d0e2e7670076d5375deda110ebeb · Nota
• https://git.kernel.org/stable/c/8dfabcba6a943a7a02ebe1e1637c361ba96acbaa · Nota
• https://git.kernel.org/stable/c/9f67a36e91bb50d358760f381f233913fe5c09f8 · Nota
• https://git.kernel.org/stable/c/55ddfc41451f01c588089cd74957a05311b6f202 · Nota
• https://git.kernel.org/stable/c/2df7059a18afb7d3aee6c36cad5d371c198111d4 · Nota