GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-72137 (GCVE-0-2026-72137)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:53 – Updated: 2026-08-17 05:40
VLAI
Title
xfrm: nat_keepalive: avoid double free on send error
Summary
In the Linux kernel, the following vulnerability has been resolved: xfrm: nat_keepalive: avoid double free on send error nat_keepalive_send() frees the keepalive skb whenever the IPv4 or IPv6 send helper reports an error. That cleanup is only correct before the skb is handed to the output path. Once ip_build_and_send_pkt() or ip6_xmit() takes ownership, the networking stack may already have consumed the skb before returning an error, so freeing it again is unsafe. Handle the pre-handoff failure cases inside nat_keepalive_send_ipv4() and nat_keepalive_send_ipv6(), where the caller still owns the skb, and keep nat_keepalive_send() responsible only for family dispatch and the unsupported-family cleanup path.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae , < d0a4dc7efa825bce60a8da8f7d43c864a159abde (git)
Affected: f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae , < 5b0c4c916f202b8fd13d12afb6af62b385622f81 (git)
Affected: f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae , < a8a7e6a9ff8a4c1f067694ddbd44be67fdf36693 (git)
Affected: f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae , < 226f4a490d1a938fc838d8f8c46a4eca864c0d78 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.11
Unaffected: 0 , < 6.11 (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/xfrm/xfrm_nat_keepalive.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d0a4dc7efa825bce60a8da8f7d43c864a159abde",
              "status": "affected",
              "version": "f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae",
              "versionType": "git"
            },
            {
              "lessThan": "5b0c4c916f202b8fd13d12afb6af62b385622f81",
              "status": "affected",
              "version": "f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae",
              "versionType": "git"
            },
            {
              "lessThan": "a8a7e6a9ff8a4c1f067694ddbd44be67fdf36693",
              "status": "affected",
              "version": "f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae",
              "versionType": "git"
            },
            {
              "lessThan": "226f4a490d1a938fc838d8f8c46a4eca864c0d78",
              "status": "affected",
              "version": "f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/xfrm/xfrm_nat_keepalive.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.11"
            },
            {
              "lessThan": "6.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: nat_keepalive: avoid double free on send error\n\nnat_keepalive_send() frees the keepalive skb whenever the IPv4 or IPv6\nsend helper reports an error.\n\nThat cleanup is only correct before the skb is handed to the output\npath. Once ip_build_and_send_pkt() or ip6_xmit() takes ownership, the\nnetworking stack may already have consumed the skb before returning an\nerror, so freeing it again is unsafe.\n\nHandle the pre-handoff failure cases inside nat_keepalive_send_ipv4()\nand nat_keepalive_send_ipv6(), where the caller still owns the skb, and\nkeep nat_keepalive_send() responsible only for family dispatch and the\nunsupported-family cleanup path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - On internet-facing IPsec VPN gateways using kernel NAT keepalive, a remote attacker can induce post-handoff outbound send failures (e.g., ENOMEM from network-driven memory pressure) when periodic keepalives are transmitted, reaching the vulnerable double-free path.\nAC:L - After an outbound ESP-in-UDP SA has NAT keepalive configured, an attacker can reliably force send errors where the stack already consumed the skb (ip6_xmit EMSGSIZE, ip_finish_output2 neighbour/ENOMEM paths) without uncontrollable races or memory layout dependencies.\nPR:N - Remote exploitation requires no privileges on the victim; it only needs a typical IPsec NAT-T deployment where userspace already set XFRMA_NAT_KEEPALIVE_INTERVAL. Local exploitation via user namespaces needs only CAP_NET_ADMIN (PR:L), not root in the init namespace.\nUI:N - No victim or administrator interaction is needed during exploitation; NAT keepalives are sent automatically by the kernel delayed work queue on the configured interval once the XFRM SA exists.\nS:U - Impact is kernel heap corruption and privilege escalation within the same security authority; this is not a VM escape, container breakout, or IOMMU/DMA boundary bypass.\nC:H - The skb double-free corrupts the slab allocator and yields use-after-free primitives that can be leveraged for arbitrary kernel memory disclosure, not merely a bounded leak or crash-only NULL dereference.\nI:H - Double-free heap corruption enables attacker-controlled reallocation of freed sk_buff objects, supporting arbitrary kernel memory writes, control-flow hijacking, and local privilege escalation.\nA:H - The double-free reliably causes slab corruption, kernel oops, or panic during keepalive send-error cleanup, providing immediate and repeatable denial of service on affected systems."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:40:47.767Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d0a4dc7efa825bce60a8da8f7d43c864a159abde"
        },
        {
          "url": "https://git.kernel.org/stable/c/5b0c4c916f202b8fd13d12afb6af62b385622f81"
        },
        {
          "url": "https://git.kernel.org/stable/c/a8a7e6a9ff8a4c1f067694ddbd44be67fdf36693"
        },
        {
          "url": "https://git.kernel.org/stable/c/226f4a490d1a938fc838d8f8c46a4eca864c0d78"
        }
      ],
      "title": "xfrm: nat_keepalive: avoid double free on send error",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-72137",
    "datePublished": "2026-08-15T05:53:11.812Z",
    "dateReserved": "2026-08-09T03:40:39.908Z",
    "dateUpdated": "2026-08-17T05:40:47.767Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72137",
      "date": "2026-09-20",
      "epss": "0.00663",
      "percentile": "0.50245"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/xfrm/xfrm_nat_keepalive.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "d0a4dc7efa825bce60a8da8f7d43c864a159abde",
                    "status": "affected",
                    "version": "f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5b0c4c916f202b8fd13d12afb6af62b385622f81",
                    "status": "affected",
                    "version": "f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a8a7e6a9ff8a4c1f067694ddbd44be67fdf36693",
                    "status": "affected",
                    "version": "f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "226f4a490d1a938fc838d8f8c46a4eca864c0d78",
                    "status": "affected",
                    "version": "f531d13bdfe3f4f084aaa8acae2cb0f02295f5ae",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/xfrm/xfrm_nat_keepalive.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.11"
                  },
                  {
                    "lessThan": "6.11",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.101",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: nat_keepalive: avoid double free on send error\n\nnat_keepalive_send() frees the keepalive skb whenever the IPv4 or IPv6\nsend helper reports an error.\n\nThat cleanup is only correct before the skb is handed to the output\npath. Once ip_build_and_send_pkt() or ip6_xmit() takes ownership, the\nnetworking stack may already have consumed the skb before returning an\nerror, so freeing it again is unsafe.\n\nHandle the pre-handoff failure cases inside nat_keepalive_send_ipv4()\nand nat_keepalive_send_ipv6(), where the caller still owns the skb, and\nkeep nat_keepalive_send() responsible only for family dispatch and the\nunsupported-family cleanup path."
          }
        ],
        "id": "CVE-2026-72137",
        "lastModified": "2026-08-17T06:18:13.583",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:21:31.223",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/226f4a490d1a938fc838d8f8c46a4eca864c0d78"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/5b0c4c916f202b8fd13d12afb6af62b385622f81"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a8a7e6a9ff8a4c1f067694ddbd44be67fdf36693"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d0a4dc7efa825bce60a8da8f7d43c864a159abde"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-28T22:19:53+00:00",
      "cve": "CVE-2026-72137",
      "id": "CVE-2026-72137",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: xfrm: nat_keepalive: avoid double free on send error",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72137.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-10T02:09:04Z",
      "cve": "CVE-2026-72137",
      "id": "CVE-2026-72137",
      "initial_release_date": "2026-08-18T16:54:50Z",
      "product_status:known_affected": "17",
      "product_status:known_not_affected": "333",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-72137",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-72137.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.