CVE-2026-64525

Name of the Vulnerable Software and Affected Versions Linux kernel version 6.18

Description An issue exists in the xfrm module where the xfrm policy fini() function incorrectly calls synchronize rcu() within the .exit handler of xfrm net ops. This violates the guidelines in include/net/net namespace.h, which warn against using blocking RCU primitives in .exit handlers. When multiple network namespaces are cleaned up, the system processes RCU grace periods serially, leading to significant performance degradation. In observed scenarios involving frequent unshare(CLONE NEWNET) calls, this caused the cleanup net() and netns wq rescuer kthread to hang, resulting in the accumulation of over 300,000 struct net objects in the cleanup queue, excessive memory consumption in /proc/meminfo, and subsequent memory cgroup (memcg) Out-Of-Memory (OOM) errors.

Recommendations For Linux kernel version 6.18, move the policy flush and associated workqueue drains to a .pre exit handler, allowing xfrm policy fini() to run in .exit and free hash tables after the guaranteed synchronize rcu expedited() call.