CVE-2026-31663

Vulnerability

The Linux kernel's IPsec (xfrm) subsystem contains a use-after-free race condition in the packet input path. When async cryptographic operations complete, xfrm_input_resume() calls dev_put() to release the device reference immediately upon re-entry. However, the packet still traverses transport_finish and the NF_HOOK netfilter hook, which can use the now-dangling skb->dev pointer. If the device is torn down concurrently, this leads to a use-after-free [1][2][3].

Exploitation

Exploitation requires an attacker to trigger the async crypto path, typically by sending IPsec-encrypted packets that cause the kernel to offload decryption to asynchronous hardware or software. The attack surface is local: an unprivileged user on the system could craft malicious packets to hit the race condition. No authentication is needed beyond the ability to receive network traffic on an IPsec-secured interface.

Impact

A successful exploit could allow an attacker to corrupt kernel memory, potentially leading to privilege escalation to root or a denial of service (system crash). The use-after-free occurs in a context where the attacker may control parts of the freed object, increasing the risk of code execution.

Mitigation

The issue is fixed in Linux kernel stable commits [1], [2], and [3]. Users should update their kernels to include these patches. No workaround is available; systems using IPsec with async crypto are vulnerable until patched.