Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-64580— xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 3.0.79至3.1之前版本、3.2.46至3.3之前版本、3.4.46至3.5之前版本、3.9.3至3.10之前版本和3.10版本存在安全漏洞，该漏洞源于错误路径上未正确清理dst.dev，导致重复释放设备引用，可能引发引用计数下溢，导致内核警告或拒绝服务。

CVSS 7.8 · High EPSS 0.12% · P2

Affected Version Matrix 22

VendorProduct Version RangeStatus
Linux Linux 84c4a9dfbf430861e7588d95ae3ff61535dca351< 97e032e5733e49471fb73de117ea2ac1ac7c479a affected
84c4a9dfbf430861e7588d95ae3ff61535dca351< df6856c2dda9187601d29b5fbd7a81b3b178cedf affected
84c4a9dfbf430861e7588d95ae3ff61535dca351< 43de8a49335e611adb271bbd52e84dfbc11fc185 affected
84c4a9dfbf430861e7588d95ae3ff61535dca351< ff636d7b7cba6dea82ecf580415ea57f2c1a11b6 affected
84c4a9dfbf430861e7588d95ae3ff61535dca351< e078da1b4e11390cff3201c19a9a1fe70c5b934f affected
84c4a9dfbf430861e7588d95ae3ff61535dca351< 136992de9bb91871084ae52d172610541c76e4d2 affected
a7e22d0c0e81dde129a51ee413644124f4b59954 affected
01b0d887f67a388fb2a658ee2bdd74e5ba146818 affected
… +14 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-64580

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst() On the error path where in6_dev_get(dev) returns NULL, xfrm6_fill_dst() releases the device reference with netdev_put() but leaves xdst->u.dst.dev set. dst_destroy() later calls netdev_put(dst->dev) again, so the same net_device reference is released twice, underflowing its refcount (ref_tracker WARNING + "unregister_netdevice: waiting for <dev> to become free"). Clear xdst->u.dst.dev after the netdev_put(), the same way the XFRM device-offload paths xfrm_dev_state_add() and xfrm_dev_policy_add() in net/xfrm/xfrm_device.c NULL ->dev when releasing the reference on error. ref_tracker: reference already released. ref_tracker: allocated in: xfrm6_fill_dst (net/ipv6/xfrm6_policy.c:86) ... udpv6_sendmsg (net/ipv6/udp.c:1696) ... ref_tracker: freed in: xfrm6_fill_dst (net/ipv6/xfrm6_policy.c:90) ... WARNING: lib/ref_tracker.c:322 at ref_tracker_free+0x58b/0x780 dst_destroy (net/core/dst.c:115) rcu_core handle_softirqs ...
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 3.0.79至3.1之前版本、3.2.46至3.3之前版本、3.4.46至3.5之前版本、3.9.3至3.10之前版本和3.10版本存在安全漏洞，该漏洞源于错误路径上未正确清理dst.dev，导致重复释放设备引用，可能引发引用计数下溢，导致内核警告或拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 84c4a9dfbf430861e7588d95ae3ff61535dca351 ~ 97e032e5733e49471fb73de117ea2ac1ac7c479a -
Linux Linux 3.10 -

II. Public POCs for CVE-2026-64580

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-64580

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-64580 (6)

Same Patch Batch · Linux · 2026-08-05 · 17 CVEs total

CVE-2026-64566 9.8 CRITICAL xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()
CVE-2026-64578 8.2 HIGH ksmbd: validate compound request size before reading StructureSize2
CVE-2026-64567 7.8 HIGH btrfs: reject free space cache with more entries than pages
CVE-2026-64568 7.8 HIGH wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure
CVE-2026-64570 7.8 HIGH wifi: mac80211: fix fils_discovery double free on alloc failure
CVE-2026-64574 7.8 HIGH wifi: mac80211: tear down new links on vif update error path
CVE-2026-64575 7.8 HIGH bpf: tcp: fix double sock release on batch realloc
CVE-2026-64581 7.8 HIGH xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
CVE-2026-64582 7.8 HIGH RDMA/rxe: Fix a use-after-free problem in rxe_mmap
CVE-2026-64577 7.5 HIGH gtp: check skb_pull_data() return in gtp1u_send_echo_resp()
CVE-2026-64576 7.1 HIGH nexthop: initialize extack in nh_res_bucket_migrate()
CVE-2026-64569 mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n
CVE-2026-64571 wifi: p54: validate RX frame length in p54_rx_eeprom_readback()
CVE-2026-64572 ipv4: fib: free fib_alias with kfree_rcu() on insert error path
CVE-2026-64573 Bluetooth: qca: fix NVM tag length underflow in TLV parser
CVE-2026-64579 xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-64580

No comments yet

Leave a comment