9.8

CVE-2026-92489

xfrm: Fix skb double-free in xfrm_dev_direct_output()

In the Linux kernel, the following vulnerability has been resolved:

xfrm: Fix skb double-free in xfrm_dev_direct_output()

A return value other than 1 from local_out() means that the skb has been
consumed or its ownership was transferred. xfrm_dev_direct_output()
nevertheless frees the skb on this path, causing a double-free when
netfilter drops the packet and invalidating any other owner.

Return the local_out() result directly, matching the ownership handling
in xfrm_output_resume().
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version bfb9b9404a53a72524ce695551755117e9d3deb0
Version < 621871b696b108026bf4b44ed4085ffa2102f417
Status affected
Version a0395e96831adee8ffa016bf958e4dce9ece656e
Version < bc9297796bfdcc8d9609236e54519a4f38737aac
Status affected
Version 5eddd76ec2fd1988f0a3450fde9730b10dd22992
Version < 02deb637e965950148752a304dd1471212dd6470
Status affected
Version 5eddd76ec2fd1988f0a3450fde9730b10dd22992
Version < 56a347950e661c1a7f8f31c43a2ea53c2323b6f4
Status affected
Version 5eddd76ec2fd1988f0a3450fde9730b10dd22992
Version < 2aed51fc58d9ce450e2c116efb956160fd06fa02
Status affected
Version d1d673a5bede3767252cff19c0ab1e5387c6f43f
Status affected
Version 6.6.85
Version < 6.6.157
Status affected
Version 6.12.21
Version < 6.12.110
Status affected
Version 6.13.9
Version < 6.14
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 6.14
Status affected
Version 0
Version < 6.14
Status unaffected
Version <= 6.6.*
Version 6.6.157
Status unaffected
Version <= 6.12.*
Version 6.12.110
Status unaffected
Version <= 6.18.*
Version 6.18.52
Status unaffected
Version <= 7.2.*
Version 7.2.6
Status unaffected
Version <= *
Version 7.3-rc1
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.46% 0.394
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
416baaa9-dc9f-4396-8d5f-8c081fb06d67 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/621871b696b108026bf4b44ed4085ffa2102f417
https://git.kernel.org/stable/c/bc9297796bfdcc8d9609236e54519a4f38737aac
https://git.kernel.org/stable/c/02deb637e965950148752a304dd1471212dd6470
https://git.kernel.org/stable/c/56a347950e661c1a7f8f31c43a2ea53c2323b6f4
https://git.kernel.org/stable/c/2aed51fc58d9ce450e2c116efb956160fd06fa02