CVE-2026-64525

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-64525
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64525.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-64525
Downstream
AZL (1)
BELL (1)
DEBIAN (1)
openSUSE (1)
ROOT (1)
SUSE (5)
UBUNTU (1)
Related
openSUSE (1)
SUSE (5)
Published
2026-07-25T09:20:49Z
Modified
2026-11-05T02:30:28Z
Summary
xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit
Details

In the Linux kernel, the following vulnerability has been resolved:

xfrm: move policy_bydst RCU sync from per-netns .exit to .pre_exit

The struct pernet_operations docstring in include/net/net_namespace.h explicitly warns against blocking RCU primitives in .exit handlers:

Exit methods using blocking RCU primitives, such as
synchronize_rcu(), should be implemented via exit_batch.
[...]
Please, avoid synchronize_rcu() at all, where it's possible.

Note that a combination of pre_exit() and exit() can
be used, since a synchronize_rcu() is guaranteed between
the calls.

xfrm_policy_fini() violates this: it calls synchronize_rcu() before freeing the policy_bydst hash tables (so no RCU reader is mid- traversal at free time), but runs from xfrm_net_ops.exit -- once per namespace -- so a cleanup_net() of N namespaces pays N full RCU grace periods serially.

Use the documented pre_exit/exit split. Move the policy flush (and the workqueue drains it depends on) into a new .pre_exit handler; xfrm_policy_fini() then runs in .exit and frees the hash tables after the synchronize_rcu_expedited() that cleanup_net() guarantees between the two phases. Providing O(1) RCU grace periods per batch instead of O(N).

Observed on Linux 6.18 with a workload doing unshare(CLONE_NEWNET) at ~13/sec sustained: cleanup_net() and the netns_wq rescuer kthread both stuck in xfrm_policy_fini()'s synchronize_rcu(), >300k struct net accumulated in the cleanup queue, Percpu in /proc/meminfo climbed to 130+ GB on 256-CPU hosts, and memcg OOMs followed. setup_net and __put_net counts were balanced, ruling out a refcount leak.

Database specific 
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64525.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
438b1f668ad58f46ce699bb48e4698a7839e3f9e
Fixed
bca6386dc08750fc7cdcbc7683473748ba3114b9
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
3733fce2871c9bca9dd18a1a23b1432ea215a094
Fixed
91cc13978ab0bc6f669139f53e7e613a860d10e0
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
069daad4f2ae9c5c108131995529d5f02392c446
Fixed
d14ae8ef88c2c6590e107db61b6adce148cec7b3
Fixed
3e52417318473782012b236d0325bf7d2266a597
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6.12.83
Fixed
6.12.93
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6.18.24
Fixed
6.18.35
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6.1.191
Fixed
6.2
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6.6.136
Fixed
6.7
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
6.19.14
Fixed
6.20
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
b2faee12538b5b008eaef65a4201eb29cb5cefb3
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
b66920a3348c0f63ba18365248fa21fbf0b3a937
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
33a3149dd81a1e2f52b80ee1e0fc380b39f3d028

Affected versions

v6.*
v6.1.191
v6.12.83
v6.12.84
v6.12.85
v6.12.86
v6.12.87
v6.12.88
v6.12.89
v6.12.90
v6.12.91
v6.12.92
v6.18.24
v6.18.25
v6.18.26
v6.18.27
v6.18.28
v6.18.29
v6.18.30
v6.18.31
v6.18.32
v6.18.33
v6.18.34
v6.19.14
v6.6.136
v6.6.137
v6.6.138
v6.6.139
v6.6.140
v6.6.141
v6.6.142
v6.6.143
v6.6.144
v6.6.145
v6.6.146
v6.6.147
v6.6.148
v6.6.149
v6.6.150
v6.6.151
v6.6.152
v6.6.153
v6.6.154
v6.6.155
v6.6.156
v6.6.157
v6.6.158
v6.6.159
v6.6.160
v6.6.161

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64525.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
6.12.93
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.35
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.0.12

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64525.json"