Socket Vulnerability in Linux Kernel by Linux Foundation

CVE-2026-64581

What is CVE-2026-64581?

A vulnerability exists in the Linux kernel related to the xfrm_user_policy function, which can lead to a double-free of the socket destination cache (sk_dst_cache). This occurs when multiple threads modify sk_dst_cache simultaneously. The vulnerability enables an unprivileged user within a user and network namespace to exploit the double-free scenario, leading to potential memory corruption. If a per-socket policy change occurs concurrently with a send operation, the same old destination can be observed and subsequently released twice, causing undefined behavior. The issue has been addressed using an atomic exchange to ensure safe cache clearing and memory release.

References