CVE-2026-46116

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete

KASAN reproduces a slab-use-after-free in __xfrm_state_delete()'s

hlist_del_rcu calls under syzkaller load on linux-6.12.y stable

(reproduced on 6.12.47, also reachable via the same code path on

torvalds/master and on the ipsec tree). Nine unique signatures cluster

in the xfrm_state lifecycle, the load-bearing one being:

BUG: KASAN: slab-use-after-free in __hlist_del include/linux/list.h:990 [inline]

BUG: KASAN: slab-use-after-free in hlist_del_rcu include/linux/rculist.h:516 [inline]

BUG: KASAN: slab-use-after-free in __xfrm_state_delete net/xfrm/xfrm_state.c

Write of size 8 at addr ffff8881198bcb70 by task kworker/u8:9/435

Workqueue: netns cleanup_net

Call Trace:

__hlist_del / hlist_del_rcu

__xfrm_state_delete

xfrm_state_delete

xfrm_state_flush

xfrm_state_fini

ops_exit_list

cleanup_net

The other observed signatures

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References