CVE-2026-64581: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64581 Overview

CVE-2026-64581 is a double-free vulnerability in the Linux kernel's IPsec transform (xfrm) subsystem. The flaw resides in xfrm_user_policy(), which clears the socket destination cache using the non-atomic __sk_dst_reset() helper. For connected UDP sockets, the transmit fast path resets the same cache locklessly with an atomic xchg(). A per-socket policy change racing a concurrent sendmsg() call can cause both code paths to observe the same old dst entry and each call dst_release() on it. The result is a use-after-free of the xfrm_dst bundle while it is still referenced.

Critical Impact
An unprivileged local user with access to a user and network namespace can trigger a slab use-after-free in dst_release(), enabling kernel memory corruption and potential local privilege escalation.

Affected Products

Linux kernel versions containing the pre-patch xfrm_user_policy() implementation using __sk_dst_reset()
Linux distributions shipping vulnerable stable kernel branches prior to the fix commits
Systems permitting unprivileged user namespace creation combined with network namespaces

Discovery Timeline

2026-08-05 - CVE-2026-64581 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-64581

Vulnerability Analysis

The vulnerability is a race condition leading to a double-free on the socket destination cache pointer sk_dst_cache. When user space calls setsockopt() with an IPsec policy option, the kernel path do_ip_setsockopt() → ip_setsockopt() reaches xfrm_user_policy(). This function invokes __sk_dst_reset(), which reads sk_dst_cache via rcu_dereference_protected(), stores NULL, and then calls dst_release() on the previous value. That sequence assumes exclusive writer access to sk_dst_cache.

However, for connected UDP sockets the transmit fast path udp_sendmsg() → sk_dst_check() → sk_dst_reset() clears the cache without the socket lock, using an atomic xchg(). If a policy change races an in-flight sendmsg(), both threads can read the same old pointer, both write NULL, and both invoke dst_release(). The single reference is dropped twice, freeing the xfrm_dst bundle while other references remain valid.

KASAN reports a slab-use-after-free write of size 4 in dst_release() originating from xfrm_user_policy(). The kernel call stack traverses do_ip_setsockopt and __x64_sys_setsockopt before entering the vulnerable path.

Root Cause

The root cause is inconsistent synchronization on sk_dst_cache. xfrm_user_policy() treats the pointer as protected by the socket lock and uses non-atomic access, while the UDP transmit path modifies the same pointer without holding that lock, relying on atomic xchg(). Mixing atomic and non-atomic writers on the same field breaks the ownership assumption required for safe dst_release().

Attack Vector

An unprivileged local attacker creates a user namespace and a nested network namespace, opens a connected UDP socket, and issues concurrent setsockopt() calls setting an IPsec policy while another thread performs sendmsg() traffic. Winning the race produces a double-free of the xfrm_dst object, corrupting slab metadata. Attackers can leverage the freed object reallocation for kernel information disclosure or local privilege escalation depending on heap-spray primitives available in the target build.

No verified proof-of-concept code is published in the referenced advisories. See the kernel commit c283e9ada7fc and kernel commit 96b678d08268 for the reproducer context.

Detection Methods for CVE-2026-64581

Indicators of Compromise

KASAN reports containing slab-use-after-free in dst_release with call stacks including xfrm_user_policy and do_ip_setsockopt
Kernel oops or panic messages referencing xfrm_dst or sk_dst_cache during setsockopt() handling
Unexpected process crashes or kernel warnings on hosts allowing unprivileged user namespaces

Detection Strategies

Enable KASAN on test and staging kernels to surface use-after-free conditions in dst_release() deterministically
Audit setsockopt() telemetry for high-frequency IP_XFRM_POLICY operations from unprivileged processes
Monitor auditd and syscall tracing (bpftrace, perf) for concurrent setsockopt and sendmsg patterns against the same socket descriptor

Monitoring Recommendations

Alert on kernel log entries containing BUG: KASAN, general protection fault, or dst_release stack frames
Track processes that create user namespaces (unshare(CLONE_NEWUSER)) followed by network namespace creation and rapid IPsec policy churn
Correlate abnormal UDP socket lifecycle events with subsequent kernel instability across the fleet

How to Mitigate CVE-2026-64581

Immediate Actions Required

Apply upstream stable kernel updates that replace __sk_dst_reset() with the atomic sk_dst_reset() inside xfrm_user_policy()
Restrict unprivileged user namespace creation by setting kernel.unprivileged_userns_clone=0 where operationally acceptable
Inventory hosts running affected kernel versions and prioritize patching systems exposing IPsec configuration to untrusted users

Patch Information

The fix replaces the non-atomic clear with the atomic sk_dst_reset(), ensuring that the cache is cleared and released through a single xchg(). Whichever caller wins the exchange releases the dst exactly once; the other observes NULL and performs no action. See the mainline patches at kernel commit c283e9ada7fc and kernel commit 96b678d08268.

Workarounds

Disable unprivileged user namespaces via sysctl -w kernel.unprivileged_userns_clone=0 on Debian and Ubuntu derivatives
Use seccomp or SELinux policies to block setsockopt() with IPsec policy options from untrusted workloads
Remove or restrict the xfrm_user kernel module on hosts that do not require per-socket IPsec policies

bash

# Configuration example: reduce attack surface until patched
sysctl -w kernel.unprivileged_userns_clone=0
echo "kernel.unprivileged_userns_clone=0" | sudo tee /etc/sysctl.d/99-cve-2026-64581.conf

# Verify kernel version after patch deployment
uname -r
dmesg | grep -i xfrm