01 Record

CVE-2026-72463

xfrm: Fix dev use-after-free in xfrm async resumption

CriticalPUBLISHEDCNA: Linux

CNA base score9.8 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

xfrm: Fix dev use-after-free in xfrm async resumption

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.44% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 38.3% of scored records. A rank, not a probability.
NVD base score: 9.8 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD analysis status: Received. NVD last modified this record on 2026-10-21.
Red Hat severity: Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-08-15 05:57Z2 MO AGO

Last updated

2026-10-21 12:44Z8 DAYS AGO

Reserved

2026-08-09

Assigning CNA

Linux

Record state

PUBLISHED

Severity

Critical (CVSS 9.8)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-825Expired Pointer DereferenceBase

Data version

5.2

Document digest

fdbc06b2698e751b937deccc1da5dd2b29d7a9ee6883f0689075643f0b6110c8

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux4236c30b437b80f673b9e08c8fae38b8d471ac9e to < fed4d3195a31125566876952ce66113ec1eb9008, 0f451b43c88bf2b9c038b414be580efee42e031b to < 1acd93259b6be269e26be5d71c224bccd1f8352f, 1c428b03840094410c5fb6a5db30640486bbbfcb to < 63a30015199912bd5055bead8001b1ae68a67cdb, 1c428b03840094410c5fb6a5db30640486bbbfcb to < 8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff, 94439cbe478b53f92223da9aae95fffb28623c3f, 5002beda5cac69d522dc54da0d5d463ed9c963d2, 6.12.94 to < 6.12.112, 6.18.23 to < 6.18.54, 6.6.160 to < 6.7, 6.19.13 to < 6.20, 7.0—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/fed4d3195a31125566876952ce66113ec1eb9008
git.kernel.orghttps://git.kernel.org/stable/c/1acd93259b6be269e26be5d71c224bccd1f8352f
git.kernel.orghttps://git.kernel.org/stable/c/63a30015199912bd5055bead8001b1ae68a67cdb
git.kernel.orghttps://git.kernel.org/stable/c/8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff

07 Fixed in

Debian 12

linux-6.12
Fixed in 6.12.113-1~deb12u1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.113-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 7.1.5-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.