Linux Kernel Vulnerability Affecting Networking Features by Linux

CVE-2026-64525

What is CVE-2026-64525?

A synchronization issue has been identified in the Linux kernel concerning the xfrm networking subsystem. The vulnerability arises from the improper handling of RCU primitives within the exit handlers for network namespaces. Specifically, the function xfrm_policy_fini() calls synchronize_rcu() at a critical moment before releasing hash tables, which can lead to prolonged wait times for RCU grace periods. This issue was observed in scenarios where the cleanup_net() function is invoked repeatedly across multiple network namespaces, resulting in substantial resource allocation and potential out-of-memory (OOM) situations due to unaddressed cleanup operations. Developers are advised to adhere to the documented pre_exit/exit split to mitigate these risks, ensuring efficient resource management in network namespace cleanup operations.

References