PT-2026-52334 · Linux · Linux

Published 2026-06-25 · Updated 2026-06-25 · CVE-2026-53239

NVD

In the Linux kernel, the following vulnerability has been resolved:

xfrm: policy: fix use-after-free on inexact bin in xfrm policy bysel ctx()

Fix the race by pruning the bin while still holding xfrm policy lock, before dropping it. Use xfrm policy inexact prune bin() directly since the lock is already held. The wrapper xfrm policy inexact prune bin() becomes unused and is removed.

Race:

CPU0 (XFRM MSG DELPOLICY) CPU1 (XFRM MSG NEWSPDINFO) ========================== ========================== xfrm policy bysel ctx(): spin lock bh(xfrm policy lock) bin = xfrm policy inexact lookup() xfrm policy unlink(pol) spin unlock bh(xfrm policy lock) xfrm policy kill(ret) // wide window, lock not held xfrm hash rebuild(): spin lock bh(xfrm policy lock) xfrm policy inexact flush(): kfree rcu(bin) // bin freed spin unlock bh(xfrm policy lock) xfrm policy inexact prune bin(bin) // UAF: bin is freed

Related Identifiers

CVE-2026-53239

Affected Products

Linux

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-53239 · Security Note
• https://git.kernel.org/stable/c/88697cf980222d5906a37bf47662dac0732e2a0f · Note
• https://git.kernel.org/stable/c/8fc536e9f6856230f19c7d13e71af064b6a77b22 · Note
• https://git.kernel.org/stable/c/7f2d76c9c03257c0782afef9d95321fa04096f60 · Note
• https://git.kernel.org/stable/c/25c8c7fb3b0b9668c7d05e209f58c158d2b020c7 · Note
• https://git.kernel.org/stable/c/ec82ea4eb220164d854f8734ca5a35e23e577b94 · Note
• https://git.kernel.org/stable/c/b5316e2b8614a87d8736941972441cb47bfd4491 · Note
• https://git.kernel.org/stable/c/42827d03f8009a6a218bacab153e21f39d6a121c · Note
• https://git.kernel.org/stable/c/c4c1ea36d83bf3c4569468ca5b8b614fda1bf821 · Note