CVE-2026-53239 PUBLISHED

xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()

Assigner: Linux
Reserved: 09.06.2026 Published: 25.06.2026 Updated: 25.06.2026

In the Linux kernel, the following vulnerability has been resolved:

xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()

Fix the race by pruning the bin while still holding xfrm_policy_lock, before dropping it. Use __xfrm_policy_inexact_prune_bin() directly since the lock is already held. The wrapper xfrm_policy_inexact_prune_bin() becomes unused and is removed.

Race:

CPU0 (XFRM_MSG_DELPOLICY) CPU1 (XFRM_MSG_NEWSPDINFO) ========================== ========================== xfrm_policy_bysel_ctx(): spin_lock_bh(xfrm_policy_lock) bin = xfrm_policy_inexact_lookup() __xfrm_policy_unlink(pol) spin_unlock_bh(xfrm_policy_lock) xfrm_policy_kill(ret) // wide window, lock not held xfrm_hash_rebuild(): spin_lock_bh(xfrm_policy_lock) __xfrm_policy_inexact_flush(): kfree_rcu(bin) // bin freed spin_unlock_bh(xfrm_policy_lock) xfrm_policy_inexact_prune_bin(bin) // UAF: bin is freed

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from 6be3b0db6db82cf056a72cc18042048edd27f8ee to 8fc536e9f6856230f19c7d13e71af064b6a77b22 (excl.)
  • affected from 6be3b0db6db82cf056a72cc18042048edd27f8ee to c4c1ea36d83bf3c4569468ca5b8b614fda1bf821 (excl.)
  • affected from 6be3b0db6db82cf056a72cc18042048edd27f8ee to 25c8c7fb3b0b9668c7d05e209f58c158d2b020c7 (excl.)
  • affected from 6be3b0db6db82cf056a72cc18042048edd27f8ee to 42827d03f8009a6a218bacab153e21f39d6a121c (excl.)
  • affected from 6be3b0db6db82cf056a72cc18042048edd27f8ee to 88697cf980222d5906a37bf47662dac0732e2a0f (excl.)
  • affected from 6be3b0db6db82cf056a72cc18042048edd27f8ee to b5316e2b8614a87d8736941972441cb47bfd4491 (excl.)
  • affected from 6be3b0db6db82cf056a72cc18042048edd27f8ee to ec82ea4eb220164d854f8734ca5a35e23e577b94 (excl.)
  • affected from 6be3b0db6db82cf056a72cc18042048edd27f8ee to 7f2d76c9c03257c0782afef9d95321fa04096f60 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 5.0 is affected
  • unaffected from 0 to 5.0 (excl.)
  • unaffected from 5.10.259 to 5.10.* (incl.)
  • unaffected from 5.15.210 to 5.15.* (incl.)
  • unaffected from 6.1.176 to 6.1.* (incl.)
  • unaffected from 6.6.143 to 6.6.* (incl.)
  • unaffected from 6.12.94 to 6.12.* (incl.)
  • unaffected from 6.18.36 to 6.18.* (incl.)
  • unaffected from 7.0.13 to 7.0.* (incl.)
  • unaffected from 7.1 to * (incl.)

References