CVE-2026-64580

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the xfrm6 fill dst() function where the dst.dev is not cleared during an error path when in6 dev get(dev) returns NULL. In this scenario, the function releases the device reference using netdev put(), but xdst->u.dst.dev remains set. Subsequently, dst destroy() calls netdev put(dst->dev) again, causing the same net device reference to be released twice. This leads to a reference count underflow, which can trigger a ref tracker warning and cause the system to wait for the device to become free during unregistration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.