CVE-2026-53239: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()

Published Jun 25, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

xfrm: policy: fix use-after-free on inexact bin in xfrmpolicybyselctx()

Fix the race by pruning the bin while still holding xfrmpolicylock, before dropping it. Use xfrmpolicyinexactprunebin() directly since the lock is already held. The wrapper xfrmpolicyinexactprunebin() becomes unused and is removed.

Race:

CPU0 (XFRMMSGDELPOLICY) CPU1 (XFRMMSGNEWSPDINFO) ========================== ========================== xfrmpolicybyselctx(): spinlockbh(xfrmpolicylock) bin = xfrmpolicyinexactlookup() xfrmpolicyunlink(pol) spinunlockbh(xfrmpolicylock) xfrmpolicykill(ret) // wide window, lock not held xfrmhashrebuild(): spinlockbh(xfrmpolicylock) xfrmpolicyinexactflush(): kfreercu(bin) // bin freed spinunlockbh(xfrmpolicylock) xfrmpolicyinexactprunebin(bin) // UAF: bin is freed

Affected Software

16 affected componentsFixes available
Linux Linux kernel
Microsoft azl3 kernel 6.6.141.1-1<6.6.143.1-1
6.6.143.1-1
Linux Linux kernel>=5.0<5.10.259
Linux Linux kernel>=5.11<5.15.210
Linux Linux kernel>=5.16<6.1.176
Linux Linux kernel>=6.2<6.6.143
Linux Linux kernel>=6.7<6.12.94
Linux Linux kernel>=6.13<6.18.36
Linux Linux kernel>=6.19<7.0.13
Linux Linux kernel=7.1-rc1
Linux Linux kernel=7.1-rc2
Linux Linux kernel=7.1-rc3
Linux Linux kernel=7.1-rc4
Linux Linux kernel=7.1-rc5
Linux Linux kernel=7.1-rc6
Linux Linux kernel=7.1-rc7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade to a fixed release to a version that resolves this vulnerability.

    Fixed in 6.6.143.1-1
  2. Compensating control

    If patching is not immediately possible, mitigate by reducing exposure to XFRM policy changes that could trigger the race (e.g., limit requests that cause xfrm_policy_inexact_prune_bin / xfrm_policy_bysel_ctx() to run concurrently).

Event History

Jun 25, 2026
CVE Published
via MITRE·08:39 AM
Data Sourced
via MITRE·08:39 AM
DescriptionSeverity
Data Sourced
via NVD·09:16 AM
RemedyDescriptionSeverityWeaknessAffected Software
Jun 27, 2026
Data Sourced
via Microsoft·08:04 AM
DescriptionSeverityWeaknessAffected Software
Updated
via Microsoft·08:04 AM
DescriptionSeverity

Frequently Asked Questions

1

What is the severity of CVE-2026-53239?

The severity of CVE-2026-53239 is rated at risk level 42.

2

What is CVE-2026-53239?

CVE-2026-53239 is a use-after-free vulnerability in the Linux kernel affecting the xfrm_policy_bysel_ctx function.

3

How do I fix CVE-2026-53239?

To fix CVE-2026-53239, ensure you are using the latest version of the Linux kernel that includes the patch for this vulnerability.

4

What could happen if CVE-2026-53239 is exploited?

If exploited, CVE-2026-53239 could lead to potential data corruption or unexpected behavior in the Linux system.

5

When was CVE-2026-53239 published?

CVE-2026-53239 was published on June 25, 2026.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203