CVE-2026-46116

Technical summary

CVE-2026-46116 is a use-after-free (CWE-416) and improper check (CWE-763) vulnerability in net/xfrm/xfrm_state.c. The __xfrm_state_delete() function uses value-based predicates (checking if x->km.seq and x->id.spi are non-zero) to decide whether to call hlist_del_rcu() on byseq and byspi hash chains. However, these scalar field checks are unreliable outside of xfrm_state_lock, creating a time-of-check–time-of-use race condition. Additionally, bydst and bysrc chains have no predicate check at all, allowing a second deletion to write through LIST_POISON. The fix replaces hlist_del_rcu() with hlist_del_init_rcu() on all four chains and switches to hlist_unhashed() checks instead of value predicates, ensuring deletions are idempotent and match actual list membership.

Business impact

A local attacker with unprivileged user access can trigger this vulnerability through IPsec policy manipulation or by creating and tearing down network namespaces under load. Exploitation can result in kernel memory corruption leading to privilege escalation to root, data exfiltration from kernel memory (including cryptographic keys and sensitive network state), or denial of service via kernel panic. For organizations running Linux-based network appliances, VPN gateways, or containerized workloads, this threatens confidentiality, integrity, and availability of network security infrastructure and potentially the systems depending on it.

Affected systems

The Linux kernel xfrm subsystem is affected. The vulnerability has been reproduced on linux-6.12.47 and is reachable via the same code path in both the upstream torvalds/master branch and the ipsec tree. Affected systems include any Linux distribution or embedded system running the kernel 6.12.x series (and potentially earlier versions sharing the same xfrm_state code). Systems with IPsec enabled or that use network namespaces (common in containerized environments, OpenStack, Kubernetes, and Docker) are at particular risk.

Exploitability

Exploitability is moderate to high for privileged attacks and user-namespace scenarios. While the CVSS 3.1 vector requires local access (AV:L) and unprivileged user privileges (PR:L), the vulnerability is reliably triggerable under load via syzkaller, indicating deterministic crash conditions exist. In container or namespace isolation contexts where non-root users can manipulate IPsec policies or rapidly create/destroy namespaces, the barrier to exploitation is low. The KEV catalog does not yet list this as actively exploited in the wild, but the predictable nature of the trigger (namespace cleanup under fuzz load) suggests weaponization risk if the vulnerability becomes widely known before patching.

Remediation

Apply kernel updates once vendors release fixed versions. The fix modifies __xfrm_state_delete() to use hlist_del_init_rcu() instead of hlist_del_rcu() for all four hash chains (bydst, bysrc, byseq, byspi), and replaces value-based predicates with hlist_unhashed() checks for byseq and byspi. This defensive approach makes list deletions idempotent—a second deletion becomes a no-op rather than memory corruption. Interim mitigation: disable IPsec if not required, restrict namespace creation to trusted users, and monitor for use-after-free or slab-use-after-free KASAN warnings in kernel logs.

Patch guidance

Monitor upstream Linux repositories and your distribution's security advisories for kernel updates incorporating the xfrm_state defensive deletion patch. Verify against the vendor advisory that patches include explicit use of hlist_del_init_rcu() on all four chains and hlist_unhashed() checks. For long-term support (LTS) kernels (6.1, 6.6, 6.12), track the stable tree backports. Test patched kernels in non-production with your typical IPsec and namespace workloads before rolling out. Given the KASAN testing that confirmed elimination of crashes post-patch, updates should be safe to deploy once available.

Detection guidance

Monitor kernel logs for KASAN warnings matching the signature: 'slab-use-after-free in __hlist_del / hlist_del_rcu in __xfrm_state_delete' or related byseq/byspi/bydst/bysrc anomalies. Syzkaller fuzzing or stress tests exercising network namespace creation/destruction or rapid IPsec policy changes may surface the bug. Systems with KASAN_GENERIC + KASAN_INLINE enabled are most likely to report crashes. In production systems without KASAN, watch for unexplained kernel panics referencing xfrm_state or memory corruption warnings. Behavioral indicators include intermittent denial of service during heavy namespace turnover (e.g., container orchestration events) or sporadic privilege escalation in multi-tenant environments.

Why prioritize this

This vulnerability merits prioritization due to its HIGH severity (CVSS 7.8), demonstrated reliability under fuzz testing, local privilege escalation potential, and presence in widely-deployed kernel versions. The xfrm subsystem is fundamental to IPsec and VPN functionality; corruption in its state management can compromise both the kernel and sensitive cryptographic material. Containers and orchestration platforms that aggressively create/tear down namespaces face elevated risk. The lack of active KEV exploitation does not reduce priority, as the deterministic crash signature lowers the barrier for malicious reproduction once details propagate. Immediate patching should rank above lower-severity CVEs.

Risk score, explained

The CVSS 3.1 score of 7.8 (HIGH) reflects local attack vector (AV:L), low attack complexity (AC:L), low privilege requirements (PR:L), no user interaction, and high impact across confidentiality, integrity, and availability (C:H/I:H/A:H). The score appropriately captures kernel memory corruption leading to privilege escalation and denial of service. The use-after-free and lack of active real-world exploitation slightly reduce practical risk compared to a remotely exploitable critical flaw, but the predictable trigger under fuzz load and prevalence of xfrm in VPN/container infrastructure justify the HIGH classification.

Frequently asked questions