CVE-2026-72463 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, network administrators, and security teams responsible for Linux systems and network devices should assess exposure and apply patches or mitigations as necessary.

Why it matters

This vulnerability in the Linux kernel's xfrm async resumption functionality can lead to system instability, potential security bypass, or privilege escalation. Linux kernel developers, network administrators, and security teams should assess exposure and apply patches or mitigations.

• Potential system crashes or instability due to use-after-free errors.
• Reference count leaks leading to device descriptor exhaustion.
• Possible security bypass or privilege escalation vectors.
• Verification of device configurations and reference counts required.

Technical summary

The Linux kernel's xfrm async resumption functionality has a use-after-free vulnerability. When xfrm async resumption holds the skb->dev reference count until after transport_finish, but xfrm_rcv_cb modifies skb->dev to a tunnel device without taking a device reference, it can lead to a use-after-free of the tunnel device and a reference count leak of the original device. This issue can cause system instability, potential security bypass, or privilege escalation. The vulnerability can be mitigated by reviewing and applying patches from the Linux kernel maintainers, monitoring network devices and Linux systems for unusual activity, and verifying device configurations and reference counts.

Defensive priority

High

Recommended defensive actions

• Review and apply patches from the Linux kernel maintainers.
• Monitor network devices and Linux systems for unusual activity.
• Verify device configurations and reference counts.
• Perform a thorough review of the system for potential security bypass or privilege escalation vectors.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, including its description and CVSS score. However, specific details about affected versions and patches are not provided in the corpus.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.