CVE-2026-64525
xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit
Description
In the Linux kernel, the following vulnerability has been resolved: xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit The struct pernet_operations docstring in include/net/net_namespace.h explicitly warns against blocking RCU primitives in .exit handlers: Exit methods using blocking RCU primitives, such as synchronize_rcu(), should be implemented via exit_batch. [...] Please, avoid synchronize_rcu() at all, where it's possible. Note that a combination of pre_exit() and exit() can be used, since a synchronize_rcu() is guaranteed between the calls. xfrm_policy_fini() violates this: it calls synchronize_rcu() before freeing the policy_bydst hash tables (so no RCU reader is mid- traversal at free time), but runs from xfrm_net_ops.exit -- once per namespace -- so a cleanup_net() of N namespaces pays N full RCU grace periods serially. Use the documented pre_exit/exit split. Move the policy flush (and the workqueue drains it depends on) into a new .pre_exit handler; xfrm_policy_fini() then runs in .exit and frees the hash tables after the synchronize_rcu_expedited() that cleanup_net() guarantees between the two phases. Providing O(1) RCU grace periods per batch instead of O(N). Observed on Linux 6.18 with a workload doing unshare(CLONE_NEWNET) at ~13/sec sustained: cleanup_net() and the netns_wq rescuer kthread both stuck in xfrm_policy_fini()'s synchronize_rcu(), >300k struct net accumulated in the cleanup queue, Percpu in /proc/meminfo climbed to 130+ GB on 256-CPU hosts, and memcg OOMs followed. setup_net and __put_net counts were balanced, ruling out a refcount leak.
INFO
Published Date :
July 25, 2026, 10:17 a.m.
Last Modified :
July 25, 2026, 10:17 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products
The following products are affected by CVE-2026-64525
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
Solution
- Update the Linux kernel to a version that includes the fix.
- Review and apply vendor-specific security patches.
- Monitor system stability after applying updates.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-64525.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-64525 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-64525
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-64525 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-64525 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 25, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '438b1f668ad58f46ce699bb48e4698a7839e3f9e', 'lessThan': 'bca6386dc08750fc7cdcbc7683473748ba3114b9', 'versionType': 'git'}, {'status': 'affected', 'version': '3733fce2871c9bca9dd18a1a23b1432ea215a094', 'lessThan': '91cc13978ab0bc6f669139f53e7e613a860d10e0', 'versionType': 'git'}, {'status': 'affected', 'version': '069daad4f2ae9c5c108131995529d5f02392c446', 'lessThan': 'd14ae8ef88c2c6590e107db61b6adce148cec7b3', 'versionType': 'git'}, {'status': 'affected', 'version': '069daad4f2ae9c5c108131995529d5f02392c446', 'lessThan': '3e52417318473782012b236d0325bf7d2266a597', 'versionType': 'git'}, {'status': 'affected', 'version': 'b66920a3348c0f63ba18365248fa21fbf0b3a937', 'versionType': 'git'}, {'status': 'affected', 'version': '33a3149dd81a1e2f52b80ee1e0fc380b39f3d028', 'versionType': 'git'}, {'status': 'affected', 'version': '6.12.83', 'lessThan': '6.12.93', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.18.24', 'lessThan': '6.18.35', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.6.136', 'lessThan': '6.7', 'versionType': 'semver'}, {'status': 'affected', 'version': '6.19.14', 'lessThan': '6.20', 'versionType': 'semver'}], 'programFiles': ['net/xfrm/xfrm_policy.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '7.0'}, {'status': 'unaffected', 'version': '0', 'lessThan': '7.0', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.12.93', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.35', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.12', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/xfrm/xfrm_policy.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit The struct pernet_operations docstring in include/net/net_namespace.h explicitly warns against blocking RCU primitives in .exit handlers: Exit methods using blocking RCU primitives, such as synchronize_rcu(), should be implemented via exit_batch. [...] Please, avoid synchronize_rcu() at all, where it's possible. Note that a combination of pre_exit() and exit() can be used, since a synchronize_rcu() is guaranteed between the calls. xfrm_policy_fini() violates this: it calls synchronize_rcu() before freeing the policy_bydst hash tables (so no RCU reader is mid- traversal at free time), but runs from xfrm_net_ops.exit -- once per namespace -- so a cleanup_net() of N namespaces pays N full RCU grace periods serially. Use the documented pre_exit/exit split. Move the policy flush (and the workqueue drains it depends on) into a new .pre_exit handler; xfrm_policy_fini() then runs in .exit and frees the hash tables after the synchronize_rcu_expedited() that cleanup_net() guarantees between the two phases. Providing O(1) RCU grace periods per batch instead of O(N). Observed on Linux 6.18 with a workload doing unshare(CLONE_NEWNET) at ~13/sec sustained: cleanup_net() and the netns_wq rescuer kthread both stuck in xfrm_policy_fini()'s synchronize_rcu(), >300k struct net accumulated in the cleanup queue, Percpu in /proc/meminfo climbed to 130+ GB on 256-CPU hosts, and memcg OOMs followed. setup_net and __put_net counts were balanced, ruling out a refcount leak. Added Reference https://git.kernel.org/stable/c/3e52417318473782012b236d0325bf7d2266a597 Added Reference https://git.kernel.org/stable/c/91cc13978ab0bc6f669139f53e7e613a860d10e0 Added Reference https://git.kernel.org/stable/c/bca6386dc08750fc7cdcbc7683473748ba3114b9 Added Reference https://git.kernel.org/stable/c/d14ae8ef88c2c6590e107db61b6adce148cec7b3