CVE-2026-92489xfrm: Fix skb double-free in xfrm_dev_direct_output()
- 9.8CriticalCVSS base score
- 0.46%Exploitation in 30 daysEPSS · top 60% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix skb double-free in xfrm_dev_direct_output() A return value other than 1 from local_out() means that the skb has been consumed or its ownership was transferred. xfrm_dev_direct_output() nevertheless frees the skb on this path, causing a double-free when netfilter drops the packet and invalidating any other owner. Return the local_out() result directly, matching the ownership handling in xfrm_output_resume().
Timeline
ID reserved
By Linux
- 1 day later
· 1 day later
Published
- 32 days later
· 32 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Received | 3.1 | Critical9.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.46% · top 60% of all CVEs (15 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.8.
Affected products
- affected bfb9b9404a53a72524ce695551755117e9d3deb0 – < 621871b696b108026bf4b44ed4085ffa2102f417
- affected a0395e96831adee8ffa016bf958e4dce9ece656e – < bc9297796bfdcc8d9609236e54519a4f38737aac
- affected 5eddd76ec2fd1988f0a3450fde9730b10dd22992 – < 02deb637e965950148752a304dd1471212dd6470
- affected 5eddd76ec2fd1988f0a3450fde9730b10dd22992 – < 56a347950e661c1a7f8f31c43a2ea53c2323b6f4
- affected 5eddd76ec2fd1988f0a3450fde9730b10dd22992 – < 2aed51fc58d9ce450e2c116efb956160fd06fa02
- affected d1d673a5bede3767252cff19c0ab1e5387c6f43f
- affected 6.6.85 – < 6.6.157
- affected 6.12.21 – < 6.12.110
- affected 6.13.9 – < 6.14
- affected 6.14
- unaffected < 6.14
- unaffected 6.6.157 – ≤ 6.6.*
- unaffected 6.12.110 – ≤ 6.12.*
- unaffected 6.18.52 – ≤ 6.18.*
- unaffected 7.2.6 – ≤ 7.2.*
- unaffected 7.3 – ≤ *
References
References5
- https://git.kernel.org/stable/c/621871b696b108026bf4b44ed4085ffa2102f417 (opens in a new tab)
- https://git.kernel.org/stable/c/bc9297796bfdcc8d9609236e54519a4f38737aac (opens in a new tab)
- https://git.kernel.org/stable/c/02deb637e965950148752a304dd1471212dd6470 (opens in a new tab)
- https://git.kernel.org/stable/c/56a347950e661c1a7f8f31c43a2ea53c2323b6f4 (opens in a new tab)
- https://git.kernel.org/stable/c/2aed51fc58d9ce450e2c116efb956160fd06fa02 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-82110 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-92489)Record last updated .