CVE-2026-64525: Linux Kernel XFRM Policy DoS Vulnerability

CVE-2026-64525 Overview

CVE-2026-64525 is a Linux kernel vulnerability in the xfrm (IPsec transformation) subsystem. The flaw exists in xfrm_policy_fini(), which calls synchronize_rcu() from the per-namespace .exit handler. When many network namespaces are torn down concurrently, cleanup_net() pays one full Read-Copy-Update (RCU) grace period per namespace serially instead of amortizing them across a batch. This produces resource exhaustion on hosts that create and destroy network namespaces at high rates, such as container runtimes.

Critical Impact
Sustained namespace churn causes cleanup_net() and the netns_wq rescuer to stall in xfrm_policy_fini(), driving Percpu memory consumption above 130 GB on 256-CPU hosts and triggering memory cgroup out-of-memory kills.

Affected Products

Linux kernel (observed on version 6.18)
Systems executing frequent unshare(CLONE_NEWNET) operations, including container and sandboxing workloads
Multi-CPU hosts where per-namespace RCU grace periods accumulate

Discovery Timeline

2026-07-25 - CVE CVE-2026-64525 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64525

Vulnerability Analysis

The struct pernet_operations contract in include/net/net_namespace.h explicitly warns against blocking RCU primitives inside .exit handlers. The recommended pattern uses a pre_exit() and exit() split, because cleanup_net() guarantees a synchronize_rcu_expedited() between the two phases. This design allows RCU grace periods to be amortized across a batch of namespaces.

The xfrm_policy_fini() function violated this contract. It invoked synchronize_rcu() before freeing the policy_bydst hash tables from the per-namespace .exit path. When N namespaces exit together, the kernel serially waits for N full grace periods rather than one shared expedited grace period. This is a Denial of Service condition caused by algorithmic inefficiency [CWE-834-class behavior].

Root Cause

The root cause is the placement of a blocking RCU synchronization inside a per-namespace .exit handler. The synchronize call correctly ensured no RCU reader remained mid-traversal before the policy_bydst hash tables were freed, but it executed once per namespace instead of once per cleanup batch. Grace period cost therefore scaled as O(N) rather than O(1).

Attack Vector

A local unprivileged workload capable of creating network namespaces can exercise the flaw by repeatedly invoking unshare(CLONE_NEWNET). The reporter observed the condition at approximately 13 namespace creations per second sustained. Over 300,000 struct net instances accumulated in the cleanup queue, cleanup_net() and the netns_wq rescuer kthread stalled inside xfrm_policy_fini(), and memory cgroup OOM kills followed. Reference counts for setup_net and __put_net remained balanced, ruling out a refcount leak.

No verified public exploit code is available. The trigger conditions are described in the upstream commit messages linked under Linux Kernel Commit 3e52417 and Linux Kernel Commit d14ae8e.

Detection Methods for CVE-2026-64525

Indicators of Compromise

Elevated Percpu values in /proc/meminfo, reaching tens or hundreds of gigabytes on high-CPU hosts.
Large backlog of struct net instances visible via cleanup_net() accounting and rising net_count in kernel debugging interfaces.
Memory cgroup OOM kill events on hosts running container or sandbox workloads with active IPsec policies.

Detection Strategies

Capture kernel stack traces of the cleanup_net workqueue and the netns_wq rescuer kthread; blocked callers inside xfrm_policy_fini and synchronize_rcu confirm the pattern.
Track the rate of unshare(CLONE_NEWNET) and network namespace churn via audit or tracing (perf, bpftrace) and correlate with Percpu memory growth.
Monitor RCU grace period counters (rcu_sched in /sys/kernel/debug/rcu) for sustained elevated activity aligned with namespace teardown.

Monitoring Recommendations

Alert on Percpu memory in /proc/meminfo exceeding a baseline threshold appropriate to the host's CPU count.
Alert on kernel worker threads blocked longer than expected in synchronize_rcu, using hung_task_timeout_secs or eBPF-based off-CPU profiling.
Log and rate-limit workloads producing sustained high namespace creation rates on multi-tenant hosts.

How to Mitigate CVE-2026-64525

Immediate Actions Required

Apply the upstream fix or the vendor kernel update that moves the policy_bydst RCU synchronization from .exit to a new .pre_exit handler.
Inventory hosts running workloads that create network namespaces at high rates, especially container platforms with IPsec policies.
Reboot patched hosts to load the corrected kernel; live patch availability depends on distribution.

Patch Information

The fix relocates the policy flush and its dependent workqueue drains into a new .pre_exit handler. xfrm_policy_fini() then runs in .exit and frees the hash tables after the synchronize_rcu_expedited() that cleanup_net() guarantees between the two phases. This restores O(1) RCU grace periods per batch. See Linux Kernel Commit 3e52417, Linux Kernel Commit 91cc139, Linux Kernel Commit bca6386, and Linux Kernel Commit d14ae8e.

Workarounds

Reduce the rate of network namespace creation and destruction on affected hosts until the patched kernel is deployed.
Restrict CAP_SYS_ADMIN and unprivileged user namespace creation for untrusted workloads via kernel.unprivileged_userns_clone=0 or equivalent policy.
Where feasible, disable or unload the xfrm subsystem on hosts that do not require IPsec, reducing exposure to the affected cleanup path.

bash

# Configuration example: restrict unprivileged namespace creation
sysctl -w kernel.unprivileged_userns_clone=0

# Verify running kernel version and confirm the patch is present
uname -r
dmesg | grep -i xfrm