CVE-2026-63919

In the Linux kernel, the following vulnerability has been resolved:

xfrm: input: hold netns during deferred transport reinjection

Transport-mode reinjection stores a struct net pointer in skb->cb and uses it later from xfrmtransreinject(). That pointer must stay valid until the deferred callback runs.

Take a netns reference when queueing deferred reinjection work and drop it after the callback completes. Use maybegetnet() so the queueing path does not revive a namespace that is already being torn down.

This keeps the existing workqueue design and fixes the netns lifetime handling in one place for all users of xfrmtransqueue_net().