In the Linux kernel, the following vulnerability has been resolved:

xfrm: hold net device reference under RCU in bundle creation

xfrm bundle create() and xfrm create dummy bundle() read dst->dev into a local pointer without taking a device reference, then pass it to xfrm fill dst(). A concurrent RTM DELLINK replaces dst->dev via dst dev put() and frees the old net device, causing a use-after-free when xfrm6 fill dst() later dereferences the stale dev pointer.

BUG: KASAN: slab-use-after-free in xfrm6 fill dst+0x82c/0x860 (net/ipv6/xfrm6 policy.c:86 netdev hold()) Read of size 8 at addr ffff8880142fe588 by task exploit/153 Call Trace: xfrm6 fill dst+0x82c/0x860 xfrm resolve and create bundle+0x21d4/0x2bd0 xfrm lookup with ifid+0x485/0x1640 ip6 dst lookup flow+0x19b/0x1e0 udpv6 sendmsg+0x1443/0x2dd0

Fix this by reading dst->dev via dst dev rcu() and keeping the RCU read-side critical section active until xfrm fill dst() has taken the required device references.