CVE-2026-64581

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A double-free issue exists in the xfrm user policy() function. The function uses sk dst reset(), which is non-atomic, to clear the socket destination cache. In a race condition involving a connected UDP socket, a per-socket policy change and a simultaneous send operation can both observe the same old destination and call dst release() on it. This results in the socket reference being dropped twice, leading to a slab-use-after-free in dst release() and freeing the xfrm dst bundle while it is still referenced. This issue is reachable by an unprivileged user via a user and network namespace.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.