CVE-2026-64580: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-64580 is a double netdev_put() vulnerability in the Linux kernel's IPv6 XFRM (IPsec) subsystem, specifically in the xfrm6_fill_dst() function in net/ipv6/xfrm6_policy.c. When in6_dev_get(dev) returns NULL on the error path, the function releases the device reference via netdev_put() but leaves xdst->u.dst.dev set; dst_destroy() subsequently calls netdev_put() again on the same pointer, underflowing the net_device reference counter. The vulnerability affects Linux kernel versions from 3.0.79 through multiple stable branches, with fixes available in 6.1.183, 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2+. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory, Microsoft Advisory).

The root cause is a use-after-free / double-release bug (CWE-415: Double Free) in the error-handling path of xfrm6_fill_dst() (net/ipv6/xfrm6_policy.c). When in6_dev_get(dev) fails and returns NULL, the function calls netdev_put() to release the device reference but does not null out xdst->u.dst.dev; when the destination cache entry is later destroyed via dst_destroy() (triggered during RCU softirq processing), netdev_put(dst->dev) is called a second time on the already-released reference, underflowing the refcount. The attack vector is local — a low-privileged user can trigger the condition by sending IPv6 UDP packets that exercise XFRM policy processing under the specific error condition. The fix mirrors the pattern already used in xfrm_dev_state_add() and xfrm_dev_policy_add() in net/xfrm/xfrm_device.c, which null out ->dev after releasing the reference on error (GitHub Advisory).

Successful exploitation causes a kernel reference counter underflow, producing ref_tracker warnings and the "unregister_netdevice: waiting for <dev> to become free" message, which can crash or destabilize the kernel — resulting in a local denial of service. The primary impact is availability; confidentiality and integrity impacts are rated High in the CVSS score, reflecting the potential for further kernel memory corruption stemming from the refcount underflow. The vulnerability is confined to the local system and does not directly enable remote code execution or lateral movement, but kernel instability could be leveraged as part of a broader local privilege escalation chain (GitHub Advisory, Microsoft Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the time of this report (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.156%, indicating a low probability of exploitation in the near term. Exploitation requires local access with low privileges, limiting the attack surface compared to remotely exploitable vulnerabilities.

1. Gain local access: Obtain a low-privileged shell on a vulnerable Linux system (kernel versions affected include branches from 3.0.79 up to the fixed versions).
2. Identify XFRM policy: Confirm that an IPv6 XFRM/IPsec policy is configured on the target system using ip xfrm policy show or ip -6 xfrm state show.
3. Trigger the error condition: Send crafted IPv6 UDP packets (e.g., via a raw socket or udpv6_sendmsg) that cause xfrm6_fill_dst() to be invoked in a state where in6_dev_get(dev) returns NULL — for example, by targeting a network interface that is being torn down or is in an inconsistent state.
4. Induce double release: The crafted traffic causes xfrm6_fill_dst() to call netdev_put() on the error path while leaving xdst->u.dst.dev non-null; when the destination entry is garbage-collected via dst_destroy() during RCU processing, a second netdev_put() is issued on the same pointer.
5. Observe kernel instability: The refcount underflow triggers a ref_tracker WARNING in kernel logs and the "unregister_netdevice: waiting for <dev> to become free" message, potentially leading to a kernel panic or system hang (GitHub Advisory).

• Logs: Kernel log (dmesg / /var/log/kern.log) entries containing ref_tracker: reference already released and stack traces referencing xfrm6_fill_dst at net/ipv6/xfrm6_policy.c:86 or :90.
• Logs: Kernel warning WARNING: lib/ref_tracker.c:322 at ref_tracker_free+0x58b/0x780 with call chain including dst_destroy, rcu_core, and handle_softirqs.
• Logs: System messages containing unregister_netdevice: waiting for <dev> to become free where <dev> is a network interface name.
• Process/Network: Unusual IPv6 UDP traffic patterns from a local process targeting interfaces undergoing state changes, visible via ss -u6 or tcpdump -i any ip6.
• System Stability: Unexpected kernel panics, soft lockups, or system hangs on hosts running IPsec/XFRM IPv6 policies.

Apply the available Linux kernel patches, which fix the issue by setting xdst->u.dst.dev = NULL immediately after calling netdev_put() on the error path in xfrm6_fill_dst(). Fixed versions include 6.1.183, 6.6.148, 6.12.101, 6.18.42, 7.1.6, and 7.2 (mainline). Microsoft has also released a patch for the Azure Linux 3 kernel (azl3_kernel_6.6.145.2-1 and later). As a temporary workaround where patching is not immediately possible, restrict local user access to systems with IPv6 XFRM/IPsec policies configured, and monitor kernel logs for ref_tracker warnings (GitHub Advisory, Microsoft Advisory).

Coverage has been limited to standard vulnerability aggregation and scanning platforms (Tenable Nessus plugin 332761, VulnDB, INCIBE-CERT). No notable researcher commentary or significant social media discussion has been identified beyond routine CVE tracking (Tenable).