CVE-2026-63919 Overview
CVE-2026-63919 is a Linux kernel vulnerability in the xfrm (IP transformation framework) input path. Transport-mode reinjection stores a struct net pointer in skb->cb and dereferences it later from xfrm_trans_reinject(). The kernel did not hold a reference to the network namespace while the deferred work was queued. If the namespace was torn down before the workqueue callback executed, the callback dereferenced freed memory. The upstream fix takes a netns reference with maybe_get_net() when queueing the work and drops it once the callback completes.
Critical Impact
A local attacker manipulating IPsec transport-mode traffic across namespace teardown can trigger a kernel use-after-free, leading to memory corruption, privilege escalation, or denial of service.
Affected Products
- Linux kernel versions containing the xfrm_trans_queue_net() deferred reinjection path
- Distributions shipping affected stable kernel branches (see referenced stable commits)
- Systems using IPsec transport mode across multiple network namespaces
Discovery Timeline
- 2026-07-19 - CVE-2026-63919 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-63919
Vulnerability Analysis
The Linux xfrm subsystem handles IPsec transformations for inbound and outbound packets. Transport-mode reinjection defers packet reprocessing to a workqueue. To route the deferred packet back to the correct network namespace, the code stashes a struct net * pointer inside the socket buffer control block (skb->cb).
The queueing path did not acquire a reference on the namespace. When userspace or an orchestration layer removed the namespace between the queueing operation and the workqueue callback, the namespace structure could be freed. When xfrm_trans_reinject() later dereferenced the stored pointer, it read and operated on freed memory.
This is a use-after-free of a struct net object, tracked in kernel security terminology under [CWE-416]. The impact spans confidentiality, integrity, and availability because kernel memory corruption enables both information disclosure and control-flow hijacking.
Root Cause
The root cause is missing reference counting on the network namespace pointer stored in skb->cb. The deferred reinjection design assumed the caller's namespace would remain valid, but namespace teardown can race with pending workqueue items. No get_net() or equivalent hold was performed before queueing.
Attack Vector
An attacker with the ability to send IPsec transport-mode traffic and influence namespace lifecycle can race namespace destruction against pending xfrm_trans_queue_net() work. Containers, virtualization hosts, and network orchestration systems that create and destroy namespaces are the most exposed environments. Successful exploitation requires local privileges sufficient to receive IPsec traffic and trigger namespace teardown.
No public proof-of-concept is available. The vulnerability is described entirely in the upstream kernel commit messages referenced by the CVE.
Detection Methods for CVE-2026-63919
Indicators of Compromise
- Kernel oops or panic messages referencing xfrm_trans_reinject, xfrm_trans_queue_net, or struct net in the call trace
- KASAN use-after-free reports naming net structures during IPsec workqueue execution
- Unexpected kernel crashes correlated with container or namespace teardown events
Detection Strategies
- Enable KASAN in test and staging kernels to surface use-after-free access in the xfrm input path
- Collect and centralize dmesg and kernel.log for automated pattern matching on xfrm_trans_* symbols
- Correlate host kernel crashes with container runtime events that delete network namespaces
Monitoring Recommendations
- Forward kernel logs to a centralized logging or SIEM platform and alert on repeated xfrm stack traces
- Track kernel build versions across the fleet against the fixed stable commit hashes
- Monitor container orchestrators for abnormal namespace churn combined with IPsec traffic
How to Mitigate CVE-2026-63919
Immediate Actions Required
- Apply the vendor kernel update that includes the upstream fix for xfrm_trans_queue_net() netns reference handling
- Inventory hosts running IPsec transport mode inside containers or with multiple network namespaces and prioritize them for patching
- Restrict CAP_NET_ADMIN and namespace-creation capabilities to trusted workloads only
Patch Information
The fix is available in the mainline and multiple stable branches. Relevant commits: 2df7059a, 48ce101c, 55ddfc41, 7ee59eda, 8dfabcba, 9f67a36e, 9f7ebb45, and c16f74dc. The patch uses maybe_get_net() at queue time and put_net() after the callback runs.
Workarounds
- Disable IPsec transport mode on hosts that do not require it until patched kernels are deployed
- Avoid tearing down network namespaces that carry active IPsec sessions; drain traffic first
- Constrain untrusted workloads from creating or destroying network namespaces via seccomp or user namespace policy
# Verify running kernel against fixed stable commits
uname -r
# Check whether xfrm transport mode is currently in use
ip xfrm state | grep -i transport
# Restrict namespace creation for an unprivileged systemd unit
# /etc/systemd/system/myservice.service.d/hardening.conf
[Service]
RestrictNamespaces=yes
CapabilityBoundingSet=~CAP_NET_ADMIN
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
