CVE-2026-72463 Linux CVE debrief

Who should care

Linux kernel developers and users, network administrators, and security teams should be aware of this vulnerability and take necessary actions to mitigate it. Affected operators and platforms should review system configurations and ensure that the Linux kernel is up-to-date. Vulnerability management and security teams should monitor system logs for potential exploitation attempts and review compensating controls for exposed systems.

Technical summary

The xfrm async resumption in the Linux kernel holds the skb->dev reference count until after transport_finish. However, xfrm_rcv_cb may modify skb->dev to a tunnel device without taking a device reference, leading to a use-after-free of the tunnel device and a reference count leak of the original device. This vulnerability can be mitigated by applying the patch from the Linux kernel repository and ensuring that the Linux kernel is up-to-date.

Defensive priority

High

Recommended defensive actions

• Apply the patch from the Linux kernel repository
• Review system configurations and ensure that the Linux kernel is up-to-date
• Monitor system logs for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide limited information about the vulnerability. Further analysis is needed to fully understand the impact and affected systems. The vulnerability affects the Linux kernel's xfrm async resumption, specifically in the handling of skb->dev reference counts. A use-after-free vulnerability can occur when xfrm_rcv_cb modifies skb->dev to a tunnel device without taking a device reference. This can lead to a reference count leak of the original device and a use-after-free of the tunnel device. Defenders should verify system configurations, ensure the Linux kernel is up-to-date, and monitor system logs for potential exploitation attempts.

Official resources