{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "1c428b03840094410c5fb6a5db30640486bbbfcb"
            },
            {
              "fixed": "63a30015199912bd5055bead8001b1ae68a67cdb"
            },
            {
              "fixed": "8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "4236c30b437b80f673b9e08c8fae38b8d471ac9e"
            },
            {
              "last_affected": "0f451b43c88bf2b9c038b414be580efee42e031b"
            },
            {
              "last_affected": "5002beda5cac69d522dc54da0d5d463ed9c963d2"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "6.12.94"
            },
            {
              "fixed": "6.13"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "6.18.23"
            },
            {
              "fixed": "6.19"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "6.19.13"
            },
            {
              "fixed": "6.20"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.1.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72463.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: Fix dev use-after-free in xfrm async resumption\n\nxfrm async resumption hold skb-\u003edev refcnt until after transport_finish.\nHowever, xfrm_rcv_cb may modify skb-\u003edev to tunnel dev without taking\ndevice reference, such as vti_rcv_cb. The subsequent async resumption\nwill decrement the tunnel device's reference count, which lead to uaf\nof tunnel dev and refcnt leak of orig dev as below:\n\nunregister_netdevice: waiting for vti1 to become free. Usage count = -2\n\nStash the original skb-\u003edev to fix refcnt imbalance. The new skb-\u003edev set\nby xfrm_rcv_cb can race with device teardown. Extend rcu protection over\nxfrm_rcv_cb and transport_finish to prevent races.",
  "id": "CVE-2026-72463",
  "modified": "2026-08-18T03:30:55.740288157Z",
  "published": "2026-08-15T05:57:07.413Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/63a30015199912bd5055bead8001b1ae68a67cdb"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8045c0df98d4f14c54e5cb875f1c9c0ce89fe4ff"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/72xxx/CVE-2026-72463.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72463"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.9.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "xfrm: Fix dev use-after-free in xfrm async resumption"
}