xfrm: Fix skb double-free in xfrm_dev_direct_output()
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fixed in 6.6.157, 6.12.110, 6.14, 6.18.52, 7.2.6
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Linux kernel's IPsec (xfrm) transformation code can free the same network packet buffer twice when netfilter drops a packet on certain direct-output paths. This double free can corrupt kernel memory, potentially causing crashes or other instability on systems using IPsec with hardware offload.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix skb double-free in xfrm_dev_direct_output() A return value other than 1 from local_out() means that the skb has been consumed or its ownership was transferred. xfrm_dev_direct_output() nevertheless frees the skb on this path, causing a double-free when netfilter drops the packet and invalidating any other owner. Return the local_out() result directly, matching the ownership handling in xfrm_output_resume().
Timeline
- CVE published
- Record last updated
Affected versions
- Linux Linux
From bfb9b9404a53a72524ce695551755117e9d3deb0 · fixed in 621871b696b108026bf4b44ed4085ffa2102f417; From a0395e96831adee8ffa016bf958e4dce9ece656e · fixed in bc9297796bfdcc8d9609236e54519a4f38737aac; From 5eddd76ec2fd1988f0a3450fde9730b10dd22992 · fixed in 02deb637e965950148752a304dd1471212dd6470; From 5eddd76ec2fd1988f0a3450fde9730b10dd22992 · fixed in 56a347950e661c1a7f8f31c43a2ea53c2323b6f4; From 5eddd76ec2fd1988f0a3450fde9730b10dd22992 · fixed in 2aed51fc58d9ce450e2c116efb956160fd06fa02; From 6.6.85 · fixed in 6.6.157; From 6.12.21 · fixed in 6.12.110; From 6.13.9 · fixed in 6.14
- Linux Linux
6.14
- KernelLinux
fixed in 6.6.157; From 6.7.0 · fixed in 6.12.110; From 6.13.0 · fixed in 6.18.52; From 6.14.0 · fixed in 7.2.6