{"cve":"CVE-2026-72451","nvd":{"published":"2026-08-15T06:22:19.087","modified":"2026-08-17T06:19:12.670","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: Fix xfrm state cache insertion race\n\nThe xfrm input state cache insertion code checks the validity of\nthe state before acquiring the global xfrm_state_lock.  Thus it's\npossible for someone else to kill the state after it passed the\nvalidity check, and then the insertion will add the dead state\nto the cache.\n\nFix this by moving the validity check inside the lock.\n\nThis entire function is called on the input path, where BH must\nbe off (e.g., the caller of this function xfrm_input acquires\nits spinlocks without disabling BH).\n\nSo there is no need to disable BH here or take the RCU read lock.\nRemove both and replace them with an assertion that trips if BH\nis accidentally enabled on some future calling path.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":[],"references":["https://git.kernel.org/stable/c/041859fd55c81ea55e76d051e39b7b79975b8c7d","https://git.kernel.org/stable/c/6dab4dec9a49121d079981ac913569f232c06b06","https://git.kernel.org/stable/c/a1a3360a0c44b8b5c134db2a9d0667b61c9cf523","https://git.kernel.org/stable/c/ddd3d0132920319ac426e12456013eadbae67e15"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:48:17.459049833+00:00"},"epss":{"cve":"CVE-2026-72451","score":0.00671,"percentile":0.52051,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}