Answer in brief
CVE-2026-72463 records a Unknown severity vulnerability in xfrm: Fix dev use-after-free in xfrm async resumption. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=1c428b03840094410c5fb6a5db30640486bbbfcb <63a30015199912bd5055bead8001b1ae68a67cdb || >=1c428b03840094410c5fb6a5db30640486bbbfcb <8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff || 4236c30b437b80f673b9e08c8fae38b8d471ac9e || 0f451b43c88bf2b9c038b414be580efee42e031b || 5002beda5cac69d522dc54da0d5d463ed9c963d2 || >=6.12.94 <6.13 || >=6.18.23 <6.19 || >=6.19.13 <6.20 | 63a30015199912bd5055bead8001b1ae68a67cdb, 8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff, 6.13, 6.19, 6.20 |
| Linux/Linuxgeneric | 7.0 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix dev use-after-free in xfrm async resumption xfrm async resumption hold skb->dev refcnt until after transport_finish. However, xfrm_rcv_cb may modify skb->dev to tunnel dev without taking device reference, such as vti_rcv_cb. The subsequent async resumption will decrement the tunnel device's reference count, which lead to uaf of tunnel dev and refcnt leak of orig dev as below: unregister_netdevice: waiting for vti1 to become free. Usage count = -2 Stash the original skb->dev to fix refcnt imbalance. The new skb->dev set by xfrm_rcv_cb can race with device teardown. Extend rcu protection over xfrm_rcv_cb and transport_finish to prevent races.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-72463 records a Unknown severity vulnerability in xfrm: Fix dev use-after-free in xfrm async resumption. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=1c428b03840094410c5fb6a5db30640486bbbfcb <63a30015199912bd5055bead8001b1ae68a67cdb || >=1c428b03840094410c5fb6a5db30640486bbbfcb <8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff || 4236c30b437b80f673b9e08c8fae38b8d471ac9e || 0f451b43c88bf2b9c038b414be580efee42e031b || 5002beda5cac69d522dc54da0d5d463ed9c963d2 || >=6.12.94 <6.13 || >=6.18.23 <6.19 || >=6.19.13 <6.20 | 63a30015199912bd5055bead8001b1ae68a67cdb, 8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff, 6.13, 6.19, 6.20 |
| Linux/Linuxgeneric | 7.0 | Not reported |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix dev use-after-free in xfrm async resumption xfrm async resumption hold skb->dev refcnt until after transport_finish. However, xfrm_rcv_cb may modify skb->dev to tunnel dev without taking device reference, such as vti_rcv_cb. The subsequent async resumption will decrement the tunnel device's reference count, which lead to uaf of tunnel dev and refcnt leak of orig dev as below: unregister_netdevice: waiting for vti1 to become free. Usage count = -2 Stash the original skb->dev to fix refcnt imbalance. The new skb->dev set by xfrm_rcv_cb can race with device teardown. Extend rcu protection over xfrm_rcv_cb and transport_finish to prevent races.
Quoted source text, attributed separately from HOL analysis.