{"id":"CVE-2026-63919","revision":"1f2a34da256645a887fccb0184b0d4ee","records":[{"revision":"1f2a34da256645a887fccb0184b0d4ee","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-63919","aliases":[],"title":"xfrm: input: hold netns during deferred transport reinjection","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: input: hold netns during deferred transport reinjection\n\nTransport-mode reinjection stores a struct net pointer in skb->cb and\nuses it later from xfrm_trans_reinject(). That pointer must stay valid\nuntil the deferred callback runs.\n\nTake a netns reference when queueing deferred reinjection work and drop\nit after the callback completes. Use maybe_get_net() so the queueing\npath does not revive a namespace that is already being torn down.\n\nThis keeps the existing workqueue design and fixes the netns lifetime\nhandling in one place for all users of xfrm_trans_queue_net().","state":0,"publishedAt":"2026-07-19T14:55:22.121+00:00","modifiedAt":"2026-10-19T20:17:56.102+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/xfrm/xfrm_input.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"7b3801927e52f8621de311277f7fc727635019e7\",\n                            \"lessThan\": \"7ee59eda8820b758ed29e1cd3222359c7b97302c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7b3801927e52f8621de311277f7fc727635019e7\",\n                            \"lessThan\": \"2df7059a18afb7d3aee6c36cad5d371c198111d4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7b3801927e52f8621de311277f7fc727635019e7\",\n                            \"lessThan\": \"8dfabcba6a943a7a02ebe1e1637c361ba96acbaa\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7b3801927e52f8621de311277f7fc727635019e7\",\n                            \"lessThan\": \"48ce101cd630d6745b6923b5bad8358bc4c119da\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7b3801927e52f8621de311277f7fc727635019e7\",\n                            \"lessThan\": \"55ddfc41451f01c588089cd74957a05311b6f202\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7b3801927e52f8621de311277f7fc727635019e7\",\n                            \"lessThan\": \"9f7ebb45a83afc3216e855e57d51bb4bc9b5232e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7b3801927e52f8621de311277f7fc727635019e7\",\n                            \"lessThan\": \"9f67a36e91bb50d358760f381f233913fe5c09f8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7b3801927e52f8621de311277f7fc727635019e7\",\n                            \"lessThan\": \"c16f74dc1d75d0e2e7670076d5375deda110ebeb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/xfrm/xfrm_input.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.6\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.6\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.259\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.210\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.176\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.143\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.93\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.35\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0.12\",\n                            \"lessThanOrEqual\": \"7.0.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/7ee59eda8820b758ed29e1cd3222359c7b97302c","https://git.kernel.org/stable/c/2df7059a18afb7d3aee6c36cad5d371c198111d4","https://git.kernel.org/stable/c/8dfabcba6a943a7a02ebe1e1637c361ba96acbaa","https://git.kernel.org/stable/c/48ce101cd630d6745b6923b5bad8358bc4c119da","https://git.kernel.org/stable/c/55ddfc41451f01c588089cd74957a05311b6f202","https://git.kernel.org/stable/c/9f7ebb45a83afc3216e855e57d51bb4bc9b5232e","https://git.kernel.org/stable/c/9f67a36e91bb50d358760f381f233913fe5c09f8","https://git.kernel.org/stable/c/c16f74dc1d75d0e2e7670076d5375deda110ebeb"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-63919","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-63919","identifiers":["CVE-2026-63919"]},"retained":false,"historicalAffected":[]}],"coverage":[]}