CVE-2026-64525: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-64525 is a denial-of-service vulnerability in the Linux kernel's XFRM (IPsec transform) subsystem, specifically in the xfrm_policy_fini() function. The flaw arises from improper use of synchronize_rcu() within the .exit handler of xfrm_net_ops, violating documented pernet_operations API restrictions. Affected kernel versions include 6.6.136 (before 6.7), 6.12.83–6.12.92, 6.18.24–6.18.34, and 6.19.14 (before 6.20), with fixes available in 6.12.93, 6.18.35, 7.0.12, and 7.1+. The vulnerability was published on July 25, 2026, with a Feedly CVSS category estimate of Medium (GitHub Advisory).

The root cause is an API violation in the Linux kernel's network namespace teardown path: xfrm_policy_fini() calls synchronize_rcu() from the .exit handler of xfrm_net_ops, but the pernet_operations documentation explicitly requires that blocking RCU primitives be placed in .exit_batch or use the pre_exit/exit split pattern. When cleanup_net() destroys N network namespaces, this results in N serialized RCU grace periods rather than a single amortized one, causing O(N) blocking instead of O(1). The fix moves the policy flush and workqueue drains into a new .pre_exit handler, allowing xfrm_policy_fini() in .exit to free hash tables after the synchronize_rcu_expedited() that cleanup_net() guarantees between the two phases. No CWE classification has been formally assigned (GitHub Advisory).

A local user with the ability to create network namespaces (e.g., via unshare(CLONE_NEWNET)) can trigger sustained namespace creation and destruction, causing cleanup_net() and the netns_wq rescuer kthread to become stuck in xfrm_policy_fini()'s synchronize_rcu(). Observed real-world effects on Linux 6.18 with ~13 unshare() calls per second included over 300,000 struct net objects accumulating in the cleanup queue, per-CPU memory (Percpu in /proc/meminfo) climbing to 130+ GB on 256-CPU hosts, and subsequent memcg out-of-memory (OOM) kills — effectively a system-wide denial of service (GitHub Advisory).

1. Prerequisite: Obtain a local account on a vulnerable Linux system (kernel versions 6.6.136, 6.12.83–6.12.92, 6.18.24–6.18.34, or 6.19.14) with permission to create user or network namespaces (e.g., unprivileged user namespaces enabled via kernel.unprivileged_userns_clone=1).
2. Trigger namespace creation loop: Write a program or script that repeatedly calls unshare(CLONE_NEWNET) (or equivalent) at a sustained rate (observed threshold: ~13/sec) to create and destroy network namespaces in rapid succession.
3. Exhaust RCU grace periods: Each namespace destruction triggers a full synchronize_rcu() call in xfrm_policy_fini(), serializing N grace periods for N namespaces and causing cleanup_net() and netns_wq kthreads to block.
4. Achieve denial of service: As the cleanup queue grows (300k+ struct net objects observed), per-CPU memory consumption escalates, eventually triggering OOM conditions and system-wide resource exhaustion (GitHub Advisory).

• Logs: Kernel logs (dmesg) showing cleanup_net or netns_wq kthreads stuck or in an uninterruptible sleep state for extended periods; OOM killer invocations in /var/log/kern.log or journalctl -k.
• Process: High counts of zombie or blocked processes associated with unshare or container runtimes; netns_wq kthread consuming CPU without progress.
• Memory: /proc/meminfo showing Percpu values abnormally high (tens of GB on multi-CPU systems); rapid growth in kernel slab memory.
• System Metrics: Sustained high rate of network namespace creation/destruction visible via ip netns list churn or monitoring tools; cleanup_net() call frequency anomalies in kernel tracing (GitHub Advisory).

Apply the upstream kernel patches that implement the pre_exit/exit split for xfrm_policy_fini(). Fixed versions are Linux kernel 6.12.93, 6.18.35, 7.0.12, and 7.1 (mainline). As a workaround where patching is not immediately possible, restrict unprivileged network namespace creation by setting kernel.unprivileged_userns_clone=0 (on distributions that support this sysctl) or enforcing namespace creation restrictions via seccomp, AppArmor, or SELinux policies. Monitor for abnormal cleanup_net() latency in environments with frequent namespace creation (GitHub Advisory).