CVE-2026-64579

In the Linux kernel, the following vulnerability has been resolved:

xfrm: policy: preallocate inexact bins before xfrmhashrebuild reinsert

xfrmhashrebuild()'s first loop preallocates the bins/chains the reinsert loop needs, so the reinsert (after hlistdelrcu()) cannot allocate or fail. But its guard is inverted: it skips policies with prefixlen < threshold and preallocates for the rest.

prefixlen < threshold is exactly when policyhashbysel() returns NULL and the reinsert takes the allocating xfrmpolicyinexactinsert() path. So the loop preallocates for the exact policies (which never allocate) and skips the inexact ones, whose bin/node is then allocated GFPATOMIC during reinsert. On failure the error path only WARNONCE()s and continues, leaving a poisoned bydst node; the next rebuild's hlistdelrcu() dereferences LISTPOISON2 and takes a GPF. Reachable under memory pressure, deterministic via failslab.

Invert the guard so preallocation covers exactly the reinserted policies; the reinsert then allocates nothing and cannot fail.

Crash: Oops: general protection fault, probably for non-canonical address 0xfbd59c0000000024: 0000 [#1] SMP KASAN NOPTI KASAN: maybe wild-memory-access in range [0xdead...] ... Workqueue: events xfrmhashrebuild RIP: 0010:xfrmhashrebuild+0x5b3/0x1190 RAX: dead000000000122 (LISTPOISON2 + offset) ... Call Trace: hlistdelrcu (include/linux/rculist.h:599) xfrmhashrebuild (net/xfrm/xfrmpolicy.c:1365) processonework (kernel/workqueue.c:3322) workerthread (kernel/workqueue.c:3486) kthread (kernel/kthread.c:436) retfromfork (arch/x86/kernel/process.c:158) retfromforkasm (arch/x86/entry/entry_64.S:245) ... Kernel panic - not syncing: Fatal exception in interrupt