CVE-2026-64580

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()<br /> <br /> On the error path where in6_dev_get(dev) returns NULL, xfrm6_fill_dst()<br /> releases the device reference with netdev_put() but leaves<br /> xdst-&gt;u.dst.dev set. dst_destroy() later calls netdev_put(dst-&gt;dev)<br /> again, so the same net_device reference is released twice, underflowing<br /> its refcount (ref_tracker WARNING + "unregister_netdevice: waiting for<br /> to become free").<br /> <br /> Clear xdst-&gt;u.dst.dev after the netdev_put(), the same way the XFRM<br /> device-offload paths xfrm_dev_state_add() and xfrm_dev_policy_add() in<br /> net/xfrm/xfrm_device.c NULL -&gt;dev when releasing the reference on error.<br /> <br /> ref_tracker: reference already released.<br /> ref_tracker: allocated in:<br /> xfrm6_fill_dst (net/ipv6/xfrm6_policy.c:86)<br /> ...<br /> udpv6_sendmsg (net/ipv6/udp.c:1696)<br /> ...<br /> ref_tracker: freed in:<br /> xfrm6_fill_dst (net/ipv6/xfrm6_policy.c:90)<br /> ...<br /> WARNING: lib/ref_tracker.c:322 at ref_tracker_free+0x58b/0x780<br /> dst_destroy (net/core/dst.c:115)<br /> rcu_core<br /> handle_softirqs<br /> ...