CVE-2026-64525

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit

The struct pernet_operations docstring in include/net/net_namespace.h

explicitly warns against blocking RCU primitives in .exit handlers:

Exit methods using blocking RCU primitives, such as

synchronize_rcu(), should be implemented via exit_batch.

[...]

Please, avoid synchronize_rcu() at all, where it's possible.

Note that a combination of pre_exit() and exit() can

be used, since a synchronize_rcu() is guaranteed between

the calls.

xfrm_policy_fini() violates this: it calls synchronize_rcu() before

freeing the policy_bydst hash tables (so no RCU reader is mid-

traversal at free time), but runs from xfrm_net_ops.exit -- once per

namespace -- so a cleanup_net() of N namespaces pays N full RCU

grace periods serially.

Use the documented pre_exit/exit split. Move the policy flush (and

the workqueue drains it depends on) into

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References