CVE-2026-64581: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-64581 is a double-free (use-after-free) vulnerability in the Linux kernel's xfrm_user_policy() function, caused by a race condition between socket policy changes and UDP packet transmission. An unprivileged local attacker can exploit this to cause a kernel crash or achieve arbitrary code execution in kernel context. The vulnerability affects Linux kernel versions starting from 4.14 through at least 7.1.x, with fixes available in stable commits. It carries a CVSS v3.1 base score of 7.8 (High) (GitHub Advisory).

The root cause is a race condition (CWE not formally assigned) in xfrm_user_policy(), which clears the socket destination cache (sk_dst_cache) using the non-atomic __sk_dst_reset() — internally calling __sk_dst_set(sk, NULL) after reading the old pointer via rcu_dereference_protected(). Concurrently, the UDP transmit fast path (udp_sendmsg → sk_dst_check → sk_dst_reset) resets the same cache atomically via xchg(). When a per-socket XFRM policy change races with an in-flight UDP send, both code paths can observe the same old dst pointer and each call dst_release() on it, dropping the socket's single reference twice and freeing the xfrm_dst bundle while it is still in use. The fix replaces the non-atomic __sk_dst_reset() with the atomic sk_dst_reset(), ensuring only one side releases the destination reference (GitHub Advisory).

Successful exploitation results in a kernel use-after-free condition, which can cause a kernel panic (denial of service) or, in a more sophisticated attack, arbitrary code execution in kernel context. The vulnerability is reachable by an unprivileged user via user and network namespaces, meaning it does not require root privileges. Full compromise of confidentiality, integrity, and availability of the affected system is possible, with potential for privilege escalation and lateral movement within a multi-tenant or containerized environment (GitHub Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.112% (2nd percentile), indicating a low near-term probability of exploitation. However, the vulnerability is reachable by unprivileged users via user/network namespaces, which lowers the practical barrier for exploitation on systems where namespace access is permitted.

1. Gain local access: Obtain an unprivileged local account on a target Linux system running a vulnerable kernel (≥4.14, ≤7.1.x) with user and network namespace access enabled.
2. Create a user/network namespace: Use unshare -rn or equivalent to enter a user and network namespace, which grants the ability to call setsockopt() with XFRM-related socket options.
3. Open a connected UDP socket: Create and connect a UDP socket to a remote address, causing the kernel to populate sk_dst_cache with an xfrm_dst bundle.
4. Trigger the race condition: Simultaneously (e.g., using two threads) — one thread continuously sends UDP packets (triggering the fast-path atomic xchg() on sk_dst_cache), while the other thread calls setsockopt() with IP_XFRM_POLICY to invoke xfrm_user_policy() and its non-atomic __sk_dst_reset().
5. Achieve double-free: When the race is won, both paths observe the same old dst pointer and each call dst_release(), resulting in a KASAN-detectable slab-use-after-free. This can be leveraged for kernel crash (DoS) or, with heap grooming techniques, for privilege escalation (GitHub Advisory).

• Logs: Kernel logs (dmesg / /var/log/kern.log) containing BUG: KASAN: slab-use-after-free in dst_release with a call trace referencing xfrm_user_policy, do_ip_setsockopt, ip_setsockopt, and __sys_setsockopt.
• Process: Processes named exploit or similar spawning threads that simultaneously call setsockopt() with XFRM policy options and send UDP traffic at high frequency.
• Network: Unusual high-rate UDP traffic from a local process to a fixed destination, combined with repeated setsockopt() syscalls on the same socket.
• System: Unexpected kernel panics or system reboots on systems with XFRM/IPsec policies configured, particularly on multi-tenant or containerized hosts (GitHub Advisory).

Apply the available kernel patches: stable commits 96b678d08268b5f5c6fc99d4289d9b7e334fc683 and c283e9ada7fcb7dd4b10592623086b2e6d2f9925 address the issue by replacing the non-atomic __sk_dst_reset() with the atomic sk_dst_reset() in xfrm_user_policy() (GitHub Advisory). As a temporary workaround, restrict unprivileged access to user and network namespaces (e.g., set kernel.unprivileged_userns_clone=0 or user.max_user_namespaces=0) to reduce the attack surface. Prioritize patching systems running Linux kernel 4.14 or later that use UDP sockets with XFRM/IPsec policies enabled.