{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-31663","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-03-09T15:48:24.129Z","datePublished":"2026-04-24T14:45:13.239Z","dateUpdated":"2026-05-11T22:13:10.803Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-05-11T22:13:10.803Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: hold dev ref until after transport_finish NF_HOOK\n\nAfter async crypto completes, xfrm_input_resume() calls dev_put()\nimmediately on re-entry before the skb reaches transport_finish.\nThe skb->dev pointer is then used inside NF_HOOK and its okfn,\nwhich can race with device teardown.\n\nRemove the dev_put from the async resumption entry and instead\ndrop the reference after the NF_HOOK call in transport_finish,\nusing a saved device pointer since NF_HOOK may consume the skb.\nThis covers NF_DROP, NF_QUEUE and NF_STOLEN paths that skip\nthe okfn.\n\nFor non-transport exits (decaps, gro, drop) and secondary\nasync return points, release the reference inline when\nasync is set."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"}}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/xfrm4_input.c","net/ipv6/xfrm6_input.c","net/xfrm/xfrm_input.c"],"versions":[{"version":"acf568ee859f098279eadf551612f103afdacb4e","lessThan":"0f451b43c88bf2b9c038b414be580efee42e031b","status":"affected","versionType":"git"},{"version":"acf568ee859f098279eadf551612f103afdacb4e","lessThan":"5002beda5cac69d522dc54da0d5d463ed9c963d2","status":"affected","versionType":"git"},{"version":"acf568ee859f098279eadf551612f103afdacb4e","lessThan":"1c428b03840094410c5fb6a5db30640486bbbfcb","status":"affected","versionType":"git"},{"version":"69895c5ea0ca2e8d7de1e6d36965d0ab9730787f","status":"affected","versionType":"git"},{"version":"833760100588acfb267dac4d6a02ab9931237739","status":"affected","versionType":"git"},{"version":"e095ecaec6d94aa2156cceb98a85d409b51190f3","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/xfrm4_input.c","net/ipv6/xfrm6_input.c","net/xfrm/xfrm_input.c"],"versions":[{"version":"4.15","status":"affected"},{"version":"0","lessThan":"4.15","status":"unaffected","versionType":"semver"},{"version":"6.18.23","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"6.19.13","lessThanOrEqual":"6.19.*","status":"unaffected","versionType":"semver"},{"version":"7.0","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.18.23"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"6.19.13"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.15","versionEndExcluding":"7.0"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.2.100"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"3.16.55"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14.24"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/0f451b43c88bf2b9c038b414be580efee42e031b"},{"url":"https://git.kernel.org/stable/c/5002beda5cac69d522dc54da0d5d463ed9c963d2"},{"url":"https://git.kernel.org/stable/c/1c428b03840094410c5fb6a5db30640486bbbfcb"}],"title":"xfrm: hold dev ref until after transport_finish NF_HOOK","x_generator":{"engine":"bippy-1.2.0"}}}}