CVE-2026-64579

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert

xfrm_hash_rebuild()'s first loop preallocates the bins/chains the reinsert

loop needs, so the reinsert (after hlist_del_rcu()) cannot allocate or

fail. But its guard is inverted: it skips policies with prefixlen <

threshold and preallocates for the rest.

prefixlen < threshold is exactly when policy_hash_bysel() returns NULL and

the reinsert takes the allocating xfrm_policy_inexact_insert() path. So the

loop preallocates for the exact policies (which never allocate) and skips

the inexact ones, whose bin/node is then allocated GFP_ATOMIC during

reinsert. On failure the error path only WARN_ONCE()s and continues,

leaving a poisoned bydst node; the next rebuild's hlist_del_rcu()

dereferences LIST_POISON2 and takes a GPF. Reachable under memory pressure,

deterministic via failslab.

Invert the guard so preallocation covers exactly the reinserted pol

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References