{
  "threat_severity" : "Important",
  "public_date" : "2026-05-28T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete",
    "id" : "2482523",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2482523"
  },
  "cvss3" : {
    "cvss3_base_score" : "7.0",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-763",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nxfrm: defensively unhash xfrm_state lists in __xfrm_state_delete\nKASAN reproduces a slab-use-after-free in __xfrm_state_delete()'s\nhlist_del_rcu calls under syzkaller load on linux-6.12.y stable\n(reproduced on 6.12.47, also reachable via the same code path on\ntorvalds/master and on the ipsec tree). Nine unique signatures cluster\nin the xfrm_state lifecycle, the load-bearing one being:\nBUG: KASAN: slab-use-after-free in __hlist_del include/linux/list.h:990 [inline]\nBUG: KASAN: slab-use-after-free in hlist_del_rcu include/linux/rculist.h:516 [inline]\nBUG: KASAN: slab-use-after-free in __xfrm_state_delete net/xfrm/xfrm_state.c\nWrite of size 8 at addr ffff8881198bcb70 by task kworker/u8:9/435\nWorkqueue: netns cleanup_net\nCall Trace:\n__hlist_del / hlist_del_rcu\n__xfrm_state_delete\nxfrm_state_delete\nxfrm_state_flush\nxfrm_state_fini\nops_exit_list\ncleanup_net\nThe other observed signatures hit the same slab object from\n__xfrm_state_lookup, xfrm_alloc_spi, __xfrm_state_insert and an OOB\nwrite variant of __xfrm_state_delete, all on the byseq/byspi\nhash chains.\n__xfrm_state_delete() guards its byseq and byspi unhashes with\nvalue-based predicates:\nif (x->km.seq)\nhlist_del_rcu(&x->byseq);\nif (x->id.spi)\nhlist_del_rcu(&x->byspi);\nwhile everywhere else in the file (e.g. state_cache, state_cache_input)\nthe safer hlist_unhashed() check is used. xfrm_alloc_spi() sets\nx->id.spi = newspi inside xfrm_state_lock and then immediately inserts\ninto byspi, but a path that observes x->id.spi != 0 outside of\nxfrm_state_lock can still skip-or-hit the byspi unhash inconsistently\nwith whether x is actually on the list. The same holds for x->km.seq\nversus byseq, and the bydst/bysrc unhashes have no predicate at all,\nso a second __xfrm_state_delete() on the same object writes through\nLIST_POISON pprev.\nThe defensive change here:\n- Use hlist_del_init_rcu() instead of hlist_del_rcu() on bydst,\nbysrc, byseq and byspi so a second deletion is a no-op rather\nthan a write through LIST_POISON pprev. The byseq/byspi nodes\nare already initialised in xfrm_state_alloc().\n- Test hlist_unhashed() rather than the value predicate for\nbyseq/byspi, so the unhash decision tracks list state rather than\nmutable scalar fields.\nEmpirical verification: applied this patch on top of v6.12.47, rebuilt,\nand re-ran the same syzkaller harness for 1h16m on a previously-crashy\nconfiguration that produced ~100 hits each of slab-use-after-free\nRead in xfrm_alloc_spi / Read in __xfrm_state_lookup / Write in\n__xfrm_state_delete. After the patch, 7.1M execs across 32 VMs at\n~1550 exec/sec produced zero xfrm_state UAF/OOB hits. /proc/slabinfo\nconfirms the xfrm_state slab is actively allocated and freed during\nthe run (~143 KiB resident), so the fuzzer is still exercising those\ncode paths -- they just no longer crash.\nReproduction:\n- Linux 6.12.47 x86_64 + KASAN_GENERIC + KASAN_INLINE + KCOV\n- syzkaller @ 746545b8b1e4c3a128db8652b340d3df90ce61db\n- 32 QEMU/KVM VMs x 2 vCPU on AWS c5.metal bare metal\n- 9 unique signatures collected in ~9h, all within xfrm_state\nlifecycle", "A flaw was found in the Linux kernel's `xfrm` (IPSec framework) subsystem. This vulnerability, a use-after-free, occurs when the system incorrectly manages memory related to security policies, specifically during the deletion of `xfrm_state` lists. An attacker with local access could exploit this flaw by triggering specific operations, leading to memory corruption. This could cause the system to become unstable, resulting in crashes or a Denial of Service (DoS), and potentially allow for unauthorized access to sensitive information or increased privileges." ],
  "affected_release" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "release_date" : "2026-07-21T00:00:00Z",
    "advisory" : "RHSA-2026:42919",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10.2",
    "package" : "kernel-0:6.12.0-211.37.1.el10_2"
  }, {
    "product_name" : "Red Hat Enterprise Linux 10.0 Extended Update Support",
    "release_date" : "2026-07-14T00:00:00Z",
    "advisory" : "RHSA-2026:39371",
    "cpe" : "cpe:/o:redhat:enterprise_linux_eus:10.0",
    "package" : "kernel-0:6.12.0-55.88.1.el10_0"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
    "release_date" : "2026-07-17T00:00:00Z",
    "advisory" : "RHSA-2026:41234",
    "cpe" : "cpe:/a:redhat:rhel_extras_rt_els:7",
    "package" : "kernel-rt-0:3.10.0-1160.156.1.rt56.1308.el7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7 Extended Lifecycle Support",
    "release_date" : "2026-07-17T00:00:00Z",
    "advisory" : "RHSA-2026:41235",
    "cpe" : "cpe:/o:redhat:rhel_els:7",
    "package" : "kernel-0:3.10.0-1160.156.1.el7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-07-14T00:00:00Z",
    "advisory" : "RHSA-2026:39180",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8::nfv",
    "package" : "kernel-rt-0:4.18.0-553.144.1.rt7.485.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2026-07-14T00:00:00Z",
    "advisory" : "RHSA-2026:39179",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8",
    "package" : "kernel-0:4.18.0-553.144.1.el8_10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-07-06T00:00:00Z",
    "advisory" : "RHSA-2026:36018",
    "cpe" : "cpe:/a:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-687.22.1.el9_8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "release_date" : "2026-07-06T00:00:00Z",
    "advisory" : "RHSA-2026:36018",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9",
    "package" : "kernel-0:5.14.0-687.22.1.el9_8"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Under investigation",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-46116\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-46116\nhttps://lore.kernel.org/linux-cve-announce/2026052814-CVE-2026-46116-73b8@gregkh/T" ],
  "name" : "CVE-2026-46116",
  "csaw" : false
}