CVE-2026-31663: xfrm: hold dev ref until after transport_finish NF_HOOK
In the Linux kernel, the following vulnerability has been resolved:
xfrm: hold dev ref until after transportfinish NFHOOK
After async crypto completes, xfrminputresume() calls devput() immediately on re-entry before the skb reaches transportfinish. The skb->dev pointer is then used inside NFHOOK and its okfn, which can race with device teardown.
Remove the devput from the async resumption entry and instead drop the reference after the NFHOOK call in transportfinish, using a saved device pointer since NFHOOK may consume the skb. This covers NFDROP, NFQUEUE and NFSTOLEN paths that skip the okfn.
For non-transport exits (decaps, gro, drop) and secondary async return points, release the reference inline when async is set.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31663?
CVE-2026-31663 has been rated as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2026-31663?
To fix CVE-2026-31663, update to the latest version of the Linux kernel where the vulnerability has been addressed.
What systems are affected by CVE-2026-31663?
CVE-2026-31663 affects systems running versions of the Linux kernel with xfrm functionality.
What is the impact of CVE-2026-31663?
The impact of CVE-2026-31663 may lead to potential disruptions in network transport operations due to improper device reference handling.
When was CVE-2026-31663 resolved?
CVE-2026-31663 was resolved in updates released as part of the Linux kernel security patches.