{"id":"CVE-2026-31663","summary":"xfrm: hold dev ref until after transport_finish NF_HOOK","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: hold dev ref until after transport_finish NF_HOOK\n\nAfter async crypto completes, xfrm_input_resume() calls dev_put()\nimmediately on re-entry before the skb reaches transport_finish.\nThe skb-\u003edev pointer is then used inside NF_HOOK and its okfn,\nwhich can race with device teardown.\n\nRemove the dev_put from the async resumption entry and instead\ndrop the reference after the NF_HOOK call in transport_finish,\nusing a saved device pointer since NF_HOOK may consume the skb.\nThis covers NF_DROP, NF_QUEUE and NF_STOLEN paths that skip\nthe okfn.\n\nFor non-transport exits (decaps, gro, drop) and secondary\nasync return points, release the reference inline when\nasync is set.","modified":"2026-11-01T02:30:54.213162485Z","published":"2026-04-24T14:45:13.239Z","related":["ALSA-2026:67471","ALSA-2026:68531","ALSA-2026:68532","ALSA-2026:68570","SUSE-SU-2026:22742-1","SUSE-SU-2026:22769-1","SUSE-SU-2026:22812-1","SUSE-SU-2026:22835-1","SUSE-SU-2026:23477-1","SUSE-SU-2026:23481-1","SUSE-SU-2026:23528-1","SUSE-SU-2026:23529-1","SUSE-SU-2026:4120-1","SUSE-SU-2026:4254-1","SUSE-SU-2026:4687-1","openSUSE-SU-2026:21388-1"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31663.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/0f451b43c88bf2b9c038b414be580efee42e031b"},{"type":"WEB","url":"https://git.kernel.org/stable/c/1c428b03840094410c5fb6a5db30640486bbbfcb"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4236c30b437b80f673b9e08c8fae38b8d471ac9e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/4d06caedea587c59cc2cc893ceecc57c75c64312"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5002beda5cac69d522dc54da0d5d463ed9c963d2"},{"type":"WEB","url":"https://git.kernel.org/stable/c/94439cbe478b53f92223da9aae95fffb28623c3f"},{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31663.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:67471"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:68531"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:68532"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:68570"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-31663"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31663.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-31663"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461462"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"acf568ee859f098279eadf551612f103afdacb4e"},{"fixed":"4d06caedea587c59cc2cc893ceecc57c75c64312"},{"fixed":"94439cbe478b53f92223da9aae95fffb28623c3f"},{"fixed":"4236c30b437b80f673b9e08c8fae38b8d471ac9e"},{"fixed":"0f451b43c88bf2b9c038b414be580efee42e031b"},{"fixed":"5002beda5cac69d522dc54da0d5d463ed9c963d2"},{"fixed":"1c428b03840094410c5fb6a5db30640486bbbfcb"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"3.2.100"},{"fixed":"3.3"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"3.16.55"},{"fixed":"3.17"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"4.14.24"},{"fixed":"4.15"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"69895c5ea0ca2e8d7de1e6d36965d0ab9730787f"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"833760100588acfb267dac4d6a02ab9931237739"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"e095ecaec6d94aa2156cceb98a85d409b51190f3"}]}],"versions":["v3.2.102","v3.2.101","v3.2.100","v3.16.85","v3.16.84","v3.16.83","v3.16.82","v3.16.81","v3.16.80","v3.16.79","v3.16.78","v3.16.77","v3.16.76","v3.16.75","v3.16.74","v3.16.73","v3.16.72","v3.16.71","v3.16.70","v3.16.69","v3.16.68","v3.16.67","v3.16.66","v3.16.65","v3.16.64","v3.16.63","v3.16.62","v3.16.61","v3.16.60","v3.16.59","v3.16.58","v3.16.57","v3.16.56","v3.16.55","v4.14.336","v4.14.335","v4.14.334","v4.14.333","v4.14.332","v4.14.331","v4.14.330","v4.14.329","v4.14.328","v4.14.327","v4.14.326","v4.14.325","v4.14.324","v4.14.323","v4.14.322","v4.14.321","v4.14.320","v4.14.319","v4.14.318","v4.14.317","v4.14.316","v4.14.315","v4.14.314","v4.14.313","v4.14.312","v4.14.311","v4.14.310","v4.14.309","v4.14.308","v4.14.307","v4.14.306","v4.14.305","v4.14.304","v4.14.303","v4.14.302","v4.14.301","v4.14.300","v4.14.299","v4.14.298","v4.14.297","v4.14.296","v4.14.295","v4.14.294","v4.14.293","v4.14.292","v4.14.291","v4.14.290","v4.14.289","v4.14.288","v4.14.287","v4.14.286","v4.14.285","v4.14.284","v4.14.283","v4.14.282","v4.14.281","v4.14.280","v4.14.279","v4.14.278","v4.14.277","v4.14.276","v4.14.275","v4.14.274","v4.14.273","v4.14.272","v4.14.271","v4.14.270","v4.14.269","v4.14.268","v4.14.267","v4.14.266","v4.14.265","v4.14.264","v4.14.263","v4.14.262","v4.14.261","v4.14.260","v4.14.259","v4.14.258","v4.14.257","v4.14.256","v4.14.255","v4.14.254","v4.14.253","v4.14.252","v4.14.251","v4.14.250","v4.14.249","v4.14.248","v4.14.247","v4.14.246","v4.14.245","v4.14.244","v4.14.243","v4.14.242","v4.14.241","v4.14.240","v4.14.239","v4.14.238","v4.14.237","v4.14.236","v4.14.235","v4.14.234","v4.14.233","v4.14.232","v4.14.231","v4.14.230","v4.14.229","v4.14.228","v4.14.227","v4.14.226","v4.14.225","v4.14.224","v4.14.223","v4.14.222","v4.14.221","v4.14.220","v4.14.219","v4.14.218","v4.14.217","v4.14.216","v4.14.215","v4.14.214","v4.14.213","v4.14.212","v4.14.211","v4.14.210","v4.14.209","v4.14.208","v4.14.207","v4.14.206","v4.14.205","v4.14.204","v4.14.203","v4.14.202","v4.14.201","v4.14.200","v4.14.199","v4.14.198","v4.14.197","v4.14.196","v4.14.195","v4.14.194","v4.14.193","v4.14.192","v4.14.191","v4.14.190","v4.14.189","v4.14.188","v4.14.187","v4.14.186","v4.14.185","v4.14.184","v4.14.183","v4.14.182","v4.14.181","v4.14.180","v4.14.179","v4.14.178","v4.14.177","v4.14.176","v4.14.175","v4.14.174","v4.14.173","v4.14.172","v4.14.171","v4.14.170","v4.14.169","v4.14.168","v4.14.167","v4.14.166","v4.14.165","v4.14.164","v4.14.163","v4.14.162","v4.14.161","v4.14.160","v4.14.159","v4.14.158","v4.14.157","v4.14.156","v4.14.155","v4.14.154","v4.14.153","v4.14.152","v4.14.151","v4.14.150","v4.14.149","v4.14.148","v4.14.147","v4.14.146","v4.14.145","v4.14.144","v4.14.143","v4.14.142","v4.14.141","v4.14.140","v4.14.139","v4.14.138","v4.14.137","v4.14.136","v4.14.135","v4.14.134","v4.14.133","v4.14.132","v4.14.131","v4.14.130","v4.14.129","v4.14.128","v4.14.127","v4.14.126","v4.14.125","v4.14.124","v4.14.123","v4.14.122","v4.14.121","v4.14.120","v4.14.119","v4.14.118","v4.14.117","v4.14.116","v4.14.115","v4.14.114","v4.14.113","v4.14.112","v4.14.111","v4.14.110","v4.14.109","v4.14.108","v4.14.107","v4.14.106","v4.14.105","v4.14.104","v4.14.103","v4.14.102","v4.14.101","v4.14.100","v4.14.99","v4.14.98","v4.14.97","v4.14.96","v4.14.95","v4.14.94","v4.14.93","v4.14.92","v4.14.91","v4.14.90","v4.14.89","v4.14.88","v4.14.87","v4.14.86","v4.14.85","v4.14.84","v4.14.83","v4.14.82","v4.14.81","v4.14.80","v4.14.79","v4.14.78","v4.14.77","v4.14.76","v4.14.75","v4.14.74","v4.14.73","v4.14.72","v4.14.71","v4.14.70","v4.14.69","v4.14.68","v4.14.67","v4.14.66","v4.14.65","v4.14.64","v4.14.63","v4.14.62","v4.14.61","v4.14.60","v4.14.59","v4.14.58","v4.14.57","v4.14.56","v4.14.55","v4.14.54","v4.14.53","v4.14.52","v4.14.51","v4.14.50","v4.14.49","v4.14.48","v4.14.47","v4.14.46","v4.14.45","v4.14.44","v4.14.43","v4.14.42","v4.14.41","v4.14.40","v4.14.39","v4.14.38","v4.14.37","v4.14.36","v4.14.35","v4.14.34","v4.14.33","v4.14.32","v4.14.31","v4.14.30","v4.14.29","v4.14.28","v4.14.27","v4.14.26","v4.14.25","v4.14.24"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31663.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.15.0"},{"fixed":"6.1.191"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.160"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.94"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.23"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"6.19.13"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-31663.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}]}