CVE-2026-92489: xfrm: Fix skb double-free in xfrm_dev_direct_output()
In the Linux kernel, the following vulnerability has been resolved:
xfrm: Fix skb double-free in xfrmdevdirectoutput()
A return value other than 1 from localout() means that the skb has been consumed or its ownership was transferred. xfrmdevdirectoutput() nevertheless frees the skb on this path, causing a double-free when netfilter drops the packet and invalidating any other owner.
Return the localout() result directly, matching the ownership handling in xfrmoutputresume().
Affected Software
Event History
Frequently Asked Questions
Does this require a netfilter rule to drop traffic?
A netfilter drop is specifically identified as a case that triggers the double-free. More generally, the unsafe path occurs when local_out() returns a value other than 1, indicating that the skb was consumed or ownership was transferred.
What packet path is relevant when assessing exposure?
The issue is in the xfrm_dev_direct_output() path. Systems are relevant if packets reach this path and local_out() can consume the skb or transfer its ownership.