CVE-2026-72137: xfrm: nat_keepalive: avoid double free on send error
In the Linux kernel, the following vulnerability has been resolved:
xfrm: natkeepalive: avoid double free on send error
natkeepalivesend() frees the keepalive skb whenever the IPv4 or IPv6 send helper reports an error.
That cleanup is only correct before the skb is handed to the output path. Once ipbuildandsendpkt() or ip6xmit() takes ownership, the networking stack may already have consumed the skb before returning an error, so freeing it again is unsafe.
Handle the pre-handoff failure cases inside natkeepalivesendipv4() and natkeepalivesendipv6(), where the caller still owns the skb, and keep natkeepalivesend() responsible only for family dispatch and the unsupported-family cleanup path.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72137?
CVE-2026-72137 has a risk score of 34, indicating a moderate severity level.
What is the impact of CVE-2026-72137?
CVE-2026-72137 can lead to a double free vulnerability in the xfrm subsystem of the Linux kernel.
How do I fix CVE-2026-72137?
To fix CVE-2026-72137, update your Linux kernel to the latest version where the vulnerability has been patched.
Which component is affected by CVE-2026-72137?
CVE-2026-72137 specifically affects the xfrm component's nat_keepalive feature in the Linux kernel.
When was CVE-2026-72137 published?
CVE-2026-72137 was published on August 15, 2026.