CVE-2026-64580: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64580 Overview

CVE-2026-64580 is a reference counting flaw in the Linux kernel IPv6 XFRM (transform) subsystem. The bug lives in xfrm6_fill_dst() within net/ipv6/xfrm6_policy.c. On the error path where in6_dev_get(dev) returns NULL, the function releases the device reference via netdev_put() but leaves xdst->u.dst.dev populated. dst_destroy() later invokes netdev_put(dst->dev) on the same pointer, decrementing the net_device refcount twice. The result is a refcount underflow that trips the ref_tracker WARNING and can leave the kernel spinning on unregister_netdevice: waiting for <dev> to become free.

Critical Impact
A local IPv6 UDP send path can trigger a net_device refcount underflow, producing kernel WARNINGs and a stuck netdev unregister that degrades networking availability.

Affected Products

Linux kernel branches containing the vulnerable xfrm6_fill_dst() implementation in net/ipv6/xfrm6_policy.c
Systems using IPv6 with XFRM/IPsec policy or transform state
Distributions shipping upstream kernels prior to the fix commits referenced by kernel.org

Discovery Timeline

2026-08-05 - CVE-2026-64580 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-64580

Vulnerability Analysis

The defect is a double-release of a struct net_device reference in the IPv6 XFRM output path. xfrm6_fill_dst() acquires a device reference during dst (destination cache) construction. When in6_dev_get(dev) fails, the error handler calls netdev_put() to drop that reference. However, it does not clear xdst->u.dst.dev. The dst object is still linked into destruction routines. When dst_destroy() runs, it calls netdev_put(dst->dev) on the same pointer, driving the refcount below its true value.

The kernel's ref_tracker infrastructure detects the second release and emits reference already released alongside a WARNING at lib/ref_tracker.c:322 in ref_tracker_free. The underflow also prevents the affected device from ever reaching a zero-holder state cleanly, producing the well-known unregister_netdevice: waiting for <dev> to become free loop when the interface is later torn down.

Root Cause

The root cause is inconsistent cleanup semantics on an error path [CWE-672 style release-after-free of resource ownership]. The XFRM device-offload paths xfrm_dev_state_add() and xfrm_dev_policy_add() in net/xfrm/xfrm_device.c correctly NULL ->dev after releasing the reference. xfrm6_fill_dst() did not, leaving the dangling pointer for dst_destroy() to double-release.

Attack Vector

The reference path is reachable through normal IPv6 socket send operations. The stack trace captured in the report shows udpv6_sendmsg() → xfrm6_fill_dst() triggering the initial allocation. A local process that generates IPv6 UDP traffic under an XFRM policy where the outbound device lookup fails can drive the error path. Repeated triggering underflows the refcount and stalls netdev unregistration, producing a denial-of-service condition on networking teardown. The vulnerability requires local access and IPv6 with XFRM configured; there is no evidence of remote-only reachability.

No public proof-of-concept is listed in the enriched data. The kernel oops signature and ref_tracker allocation/free traces at net/ipv6/xfrm6_policy.c:86 and net/ipv6/xfrm6_policy.c:90 are the primary technical artifacts. See the Linux Kernel Commit 43de8a49 and related stable backports for the exact source diff.

Detection Methods for CVE-2026-64580

Indicators of Compromise

Kernel log entries containing ref_tracker: reference already released with allocator frame xfrm6_fill_dst.
WARNING: lib/ref_tracker.c:322 at ref_tracker_free+ stack traces originating from dst_destroy under rcu_core/handle_softirqs.
Repeated unregister_netdevice: waiting for <dev> to become free messages during interface teardown on IPv6/XFRM-enabled hosts.

Detection Strategies

Monitor dmesg and /var/log/kern.log for the specific ref_tracker warning tied to xfrm6_fill_dst frames and alert on any occurrence.
Correlate netdev unregister stalls with prior IPv6 UDP send activity from processes using IPsec/XFRM policies.
Compare running kernel versions against the fix commits referenced by kernel.org stable trees to identify unpatched hosts across the fleet.

Monitoring Recommendations

Forward kernel ring buffer output to a central log store and build a query for ref_tracker and xfrm6_fill_dst co-occurrence.
Track net_device refcount health via /sys/class/net/<iface>/ counters and alert on interfaces stuck in unregister state.
Baseline XFRM policy churn on production hosts so anomalous error rates from IPv6 output path stand out.

How to Mitigate CVE-2026-64580

Immediate Actions Required

Apply the upstream and stable-tree kernel patches that clear xdst->u.dst.dev after netdev_put() in xfrm6_fill_dst().
Reboot affected hosts after patching; the fix is in kernel code and cannot be hot-loaded on standard builds.
Inventory hosts running IPv6 with XFRM/IPsec and prioritize them for the update cycle.

Patch Information

The fix mirrors the pattern used by xfrm_dev_state_add() and xfrm_dev_policy_add(): after releasing the device reference on the error path, set xdst->u.dst.dev = NULL so dst_destroy() does not perform a second netdev_put(). Stable-tree backports are available in the following commits: Linux Kernel Commit 136992de, Linux Kernel Commit 43de8a49, Linux Kernel Commit df6856c2, Linux Kernel Commit e078da1b4, and Linux Kernel Commit ff636d7b7. Consult your distribution's security tracker for the corresponding vendor package versions.

Workarounds

Disable IPv6 XFRM/IPsec policies on hosts that do not require them until a patched kernel is deployed.
Restrict local user capability to configure XFRM state or send IPv6 traffic through affected policies to reduce error-path triggers.
Where feasible, disable IPv6 entirely on systems that only need IPv4 networking, eliminating the vulnerable code path.

bash

# Verify running kernel and check for the fixed commit in your distribution's changelog
uname -r
# Example: query current XFRM state and policy usage on the host
ip -s xfrm state
ip -s xfrm policy
# Optional: disable IPv6 as a temporary workaround where the network design permits
sysctl -w net.ipv6.conf.all.disable_ipv6=1
sysctl -w net.ipv6.conf.default.disable_ipv6=1