CVE-2026-72463

CVE-2026-72463 is a use-after-free in the Linux kernel's XFRM subsystem stemming from an asymmetric refcounting contract in the async callback interface. The vulnerability isn't a one-off programmer error — it's an emergent systems design failure where XFRM's async resumption pathway assumes stable ownership of skb->dev, but callback handlers like vti_rcv_cb can redirect this pointer without acquiring a reference. When the async path later decrements what it believes is its reference, the target device's refcount goes negative while the original device's refcount leaks. The core problem: the kernel has no type-level mechanism to enforce that callbacks mutating skb->dev do so reference-safely. The xfrm_rcv_cb interface permits mutation, but the refcounting obligation is implicit — inherited, not specified. This is why the fix stashes the original device and extends RCU protection over the callback window. It addresses the race, but it doesn't resolve the contract ambiguity; it papers over the capability leak by holding both states simultaneously. The pattern is likely not isolated. Every callback that can mutate skb metadata without clear refcounting protocols creates latent UAF conditions that only manifest under specific timing pressure during device teardown. Tunnel implementations, IPsec handlers, and other subsystems with async callback pathways should be audited for the same mutation-without-reference pattern. The RCU extension closes the race for this specific callchain, but it does nothing for the next callback mutating skb->dev through a different async resumption pathway. Check whether your kernel version includes the stashing and RCU extension for xfrm_rcv_cb and transport_finish. If you're maintaining downstream kernels or custom networking modules, audit any callback handlers that modify skb->dev — they likely inherit an undocumented refcounting obligation that the kernel cannot verify at compile time.

Reviewed through automated stages and approved by a human before publication.