CVE-2026-63919: xfrm: input: hold netns during deferred transport reinjection
In the Linux kernel, the following vulnerability has been resolved:
xfrm: input: hold netns during deferred transport reinjection
Transport-mode reinjection stores a struct net pointer in skb->cb and uses it later from xfrmtransreinject(). That pointer must stay valid until the deferred callback runs.
Take a netns reference when queueing deferred reinjection work and drop it after the callback completes. Use maybegetnet() so the queueing path does not revive a namespace that is already being torn down.
This keeps the existing workqueue design and fixes the netns lifetime handling in one place for all users of xfrmtransqueuenet().
Other sources
In the Linux kernel, the following vulnerability has been resolved:
xfrm: input: hold netns during deferred transport reinjection
Transport-mode reinjection stores a struct net pointer in skb-cb and uses it later from xfrmtransreinject(). That pointer must stay valid until the deferred callback runs.
Take a netns reference when queueing deferred reinjection work and drop it after the callback completes. Use maybegetnet() so the queueing path does not revive a namespace that is already being torn down.
This keeps the existing workqueue design and fixes the netns lifetime handling in one place for all users of xfrmtransqueuenet().
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In xfrm transport-mode deferred reinjection, take a netns reference with maybe_get_net() when queueing work, retain the struct net pointer in skb->cb for xfrm_trans_reinject(), and drop the reference after the deferred callback completes; do not revive a namespace that is already being torn down.