{"uuid": "4d3389d1-6687-4ba7-ae6f-3f6e31664311", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-72137", "type": "seen", "source": "https://gist.github.com/alon710/1f27b9da2e1bcf7c04287c9ec4420dba", "content": "# CVE-2026-72137: CVE-2026-72137: Double Free in Linux Kernel XFRM NAT Keepalive\n\n> **CVSS Score:** 9.8\n> **Published:** 2026-08-15\n> **Full Report:** https://cvereports.com/reports/CVE-2026-72137\n\n## Summary\nCVE-2026-72137 is a critical double-free vulnerability in the Linux kernel's XFRM (IPsec) subsystem. The vulnerability occurs when the kernel attempts to send NAT keepalive packets over UDP. Under specific transmission failure conditions, both the downstream networking stack and the upstream keepalive dispatcher attempt to free the same socket buffer (sk_buff) structure, leading to kernel memory corruption, denial of service, or potential local privilege escalation.\n\n## TL;DR\nA double-free vulnerability in the Linux kernel XFRM subsystem allows error-handling paths to release a socket buffer twice, causing kernel crashes or potential local privilege escalation.\n\n## Technical Details\n\n- **CWE ID**: CWE-415 (Double Free)\n- **Attack Vector**: Network (AV:N)\n- **CVSS Score**: 9.8 (Critical)\n- **EPSS Score**: 0.00671 (Percentile: 50.32%)\n- **Exploit Status**: None (No public exploit available)\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Linux Kernel versions 6.11 through 6.12.100\n- Linux Kernel versions 6.13 through 6.18.39\n- Linux Kernel versions 6.19 through 7.1.4\n- **Linux Kernel**: [6.11.0, 6.12.101) (Fixed in: `6.12.101`)\n- **Linux Kernel**: [6.13.0, 6.18.40) (Fixed in: `6.18.40`)\n- **Linux Kernel**: [6.19.0, 7.1.5) (Fixed in: `7.1.5`)\n\n## Mitigation\n\n- Upgrade the Linux kernel to patched versions (6.12.101, 6.18.40, 7.1.5, or higher).\n- Disable UDP encapsulation of IPsec (NAT-Traversal) if not required, to prevent NAT keepalive generation.\n- Restrict the CAP_NET_ADMIN capability for untrusted local users and containers to block route and interface manipulation.\n\n**Remediation Steps:**\n1. Identify the running kernel version using 'uname -r'.\n2. Apply updates from your distribution's package manager to acquire the patched kernel version.\n3. Reboot the host to apply the new kernel.\n4. Verify that XFRM NAT keepalives are disabled or running on a patched kernel.\n\n## References\n\n- [Official NVD Registry](https://nvd.nist.gov/vuln/detail/CVE-2026-72137)\n- [Official CVE Record](https://www.cve.org/CVERecord?id=CVE-2026-72137)\n- [Kernel Mainline Patch](https://git.kernel.org/stable/c/226f4a490d1a938fc838d8f8c46a4eca864c0d78)\n- [Wiz Vulnerability Database Listing](https://www.wiz.io/vulnerability-database/cve/cve-2026-72137)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-72137) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-10-06T10:00:32.000000Z"}