CVE-2026-53239: xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()
In the Linux kernel, the following vulnerability has been resolved:
xfrm: policy: fix use-after-free on inexact bin in xfrmpolicybyselctx()
Fix the race by pruning the bin while still holding xfrmpolicylock, before dropping it. Use xfrmpolicyinexactprunebin() directly since the lock is already held. The wrapper xfrmpolicyinexactprunebin() becomes unused and is removed.
Race:
CPU0 (XFRMMSGDELPOLICY) CPU1 (XFRMMSGNEWSPDINFO) ========================== ========================== xfrmpolicybyselctx(): spinlockbh(xfrmpolicylock) bin = xfrmpolicyinexactlookup() xfrmpolicyunlink(pol) spinunlockbh(xfrmpolicylock) xfrmpolicykill(ret) // wide window, lock not held xfrmhashrebuild(): spinlockbh(xfrmpolicylock) xfrmpolicyinexactflush(): kfreercu(bin) // bin freed spinunlockbh(xfrmpolicylock) xfrmpolicyinexactprunebin(bin) // UAF: bin is freed
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Compensating control
If patching is not immediately possible, mitigate by reducing exposure to XFRM policy changes that could trigger the race (e.g., limit requests that cause xfrm_policy_inexact_prune_bin / xfrm_policy_bysel_ctx() to run concurrently).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53239?
The severity of CVE-2026-53239 is rated at risk level 42.
What is CVE-2026-53239?
CVE-2026-53239 is a use-after-free vulnerability in the Linux kernel affecting the xfrm_policy_bysel_ctx function.
How do I fix CVE-2026-53239?
To fix CVE-2026-53239, ensure you are using the latest version of the Linux kernel that includes the patch for this vulnerability.
What could happen if CVE-2026-53239 is exploited?
If exploited, CVE-2026-53239 could lead to potential data corruption or unexpected behavior in the Linux system.
When was CVE-2026-53239 published?
CVE-2026-53239 was published on June 25, 2026.