CVE-2026-53239

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx()<br /> <br /> Fix the race by pruning the bin while still holding xfrm_policy_lock,<br /> before dropping it. Use __xfrm_policy_inexact_prune_bin() directly since<br /> the lock is already held. The wrapper xfrm_policy_inexact_prune_bin()<br /> becomes unused and is removed.<br /> <br /> Race:<br /> <br /> CPU0 (XFRM_MSG_DELPOLICY) CPU1 (XFRM_MSG_NEWSPDINFO)<br /> ========================== ==========================<br /> xfrm_policy_bysel_ctx():<br /> spin_lock_bh(xfrm_policy_lock)<br /> bin = xfrm_policy_inexact_lookup()<br /> __xfrm_policy_unlink(pol)<br /> spin_unlock_bh(xfrm_policy_lock)<br /> xfrm_policy_kill(ret)<br /> // wide window, lock not held<br /> xfrm_hash_rebuild():<br /> spin_lock_bh(xfrm_policy_lock)<br /> __xfrm_policy_inexact_flush():<br /> kfree_rcu(bin) // bin freed<br /> spin_unlock_bh(xfrm_policy_lock)<br /> xfrm_policy_inexact_prune_bin(bin)<br /> // UAF: bin is freed