CVE-2026-72137

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to July 2026

Description A double free issue exists in the xfrm component of the Linux kernel. The nat keepalive send() function frees the keepalive skb (socket buffer) whenever the IPv4 or IPv6 send helper reports an error. This cleanup is unsafe once the skb is handed to the output path via ip build and send pkt() or ip6 xmit(), as the networking stack may have already consumed the skb before returning an error. This flaw can be exploited to achieve local privilege escalation.

Recommendations Update the Linux kernel to the version released in July 2026 or later.