PT-2026-35015 · Linux · Linux

Published 2026-04-24 · Updated 2026-04-24 · CVE-2026-31663

Mitre

In the Linux kernel, the following vulnerability has been resolved:

xfrm: hold dev ref until after transport finish NF HOOK

After async crypto completes, xfrm input resume() calls dev put() immediately on re-entry before the skb reaches transport finish. The skb->dev pointer is then used inside NF HOOK and its okfn, which can race with device teardown.

Remove the dev put from the async resumption entry and instead drop the reference after the NF HOOK call in transport finish, using a saved device pointer since NF HOOK may consume the skb. This covers NF DROP, NF QUEUE and NF STOLEN paths that skip the okfn.

For non-transport exits (decaps, gro, drop) and secondary async return points, release the reference inline when async is set.

Related Identifiers

CVE-2026-31663

Affected Products

Linux

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-31663 · Security Note
• https://git.kernel.org/stable/c/1c428b03840094410c5fb6a5db30640486bbbfcb · Note
• https://twitter.com/CVEnew/status/2047731913213751301 · Twitter Post
• https://git.kernel.org/stable/c/0f451b43c88bf2b9c038b414be580efee42e031b · Note
• https://git.kernel.org/stable/c/5002beda5cac69d522dc54da0d5d463ed9c963d2 · Note