Cloudanix VulnDB

CVE-2026-92489

Critical · 9.8

CVSS

9.8

EPSS

0.5%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the Linux kernel can let attackers remotely crash or take over affected computers and network devices.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Double-free of an skb in xfrm_dev_direct_output() when local_out() returns a value other than 1, allowing netfilter to consume the buffer and the caller to free it again, resulting in memory corruption.

Why it matters to the business

Remote attackers can crash or potentially take control of Linux-based systems and network appliances, leading to service outages, data exposure, or full host compromise with high urgency due to the 37-day-old critical flaw.

How an attack unfolds

An attacker sends network traffic that reaches the XFRM output path; when netfilter drops the skb, the erroneous second free triggers memory corruption that can be leveraged for code execution or denial of service.

How to fix it

Upgrade the Linux kernel to a version containing the fix that returns the local_out() result directly; apply vendor-supplied kernel updates as soon as available.

How to confirm the fix worked

Confirm the installed kernel contains the commit that returns the local_out() result; verify with kernel version checks and reproduction tests that exercise the xfrm_dev_direct_output path under netfilter drops.

Typical attack path

  1. Send crafted IP packets that traverse XFRM output processing
  2. Trigger netfilter rules that consume the skb
  3. Force the double-free path in xfrm_dev_direct_output()
  4. Exploit resulting memory corruption for arbitrary code execution or crash

How to detect it

Search kernel logs and crash dumps for stack traces containing xfrm_dev_direct_output, skb double-free indicators, and netfilter drop paths; correlate with unusual XFRM-related traffic.

  • xfrm_dev_direct_output
  • skb double-free
  • local_out result handling

What your security team should do

  • Patch Linux kernels to the fixed version immediately given the CVSS 9.8 rating
  • Monitor for kernel oops or panic reports involving xfrm
  • Apply network segmentation and firewall rules to limit exposure until patched
  • Review EPSS trend and re-assess exploit maturity weekly

The record

In the Linux kernel, the following vulnerability has been resolved: xfrm: Fix skb double-free in xfrm_dev_direct_output() A return value other than 1 from local_out() means that the skb has been consumed or its ownership was transferred. xfrm_dev_direct_output() nevertheless frees the skb on this path, causing a double-free when netfilter drops the packet and invalidating any other owner. Return the local_out() result directly, matching the ownership handling in xfrm_output_resume().

Affected packages

Ecosystem Package Introduced Fixed