CVE-2026-64580

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()

On the error path where in6_dev_get(dev) returns NULL, xfrm6_fill_dst()

releases the device reference with netdev_put() but leaves

xdst->u.dst.dev set. dst_destroy() later calls netdev_put(dst->dev)

again, so the same net_device reference is released twice, underflowing

its refcount (ref_tracker WARNING + "unregister_netdevice: waiting for

<dev> to become free").

Clear xdst->u.dst.dev after the netdev_put(), the same way the XFRM

device-offload paths xfrm_dev_state_add() and xfrm_dev_policy_add() in

net/xfrm/xfrm_device.c NULL ->dev when releasing the reference on error.

ref_tracker: reference already released.

ref_tracker: allocated in:

xfrm6_fill_dst (net/ipv6/xfrm6_policy.c:86)

...

udpv6_sendmsg (net/ipv6/udp.c:1696)

...

ref_tracker: freed in:

xfrm6_fill_dst (net/ipv6/xfrm6_policy.c:90)

...

WARNING: lib/ref_tra

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References