---
id: CVE-2026-64579
title: 'xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert

  xfrm_hash_rebuild()'s first loop preallocates the bins/chains the reinsert
  loop needs, so the …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 24969facd704a5f0dd8e08da86bf32a9ce972bee <
    e48f4c3e3df35b34be719d72d737bbeaca77cf0c
  - >-
    Linux >= 24969facd704a5f0dd8e08da86bf32a9ce972bee <
    1cdeed9df1306f1a277e715600772640d63defa9
  - >-
    Linux >= 24969facd704a5f0dd8e08da86bf32a9ce972bee <
    43a4d510523779891cf8eca7ffb4a086b0b5d8bf
  - >-
    Linux >= 24969facd704a5f0dd8e08da86bf32a9ce972bee <
    d9d9cc21cc90014724a14c447e3d587be9447107
  - >-
    Linux >= 24969facd704a5f0dd8e08da86bf32a9ce972bee <
    94c00391a5117530188334f740ce26d3f1256190
  - >-
    Linux >= 24969facd704a5f0dd8e08da86bf32a9ce972bee <
    7acc5ed2f33608a3d83b64f50a5766843b6e2485
  - >-
    Linux >= 24969facd704a5f0dd8e08da86bf32a9ce972bee <
    6aa3796d18a9fda953ad76a62b57bf6c145cb9ef
  - >-
    Linux >= 24969facd704a5f0dd8e08da86bf32a9ce972bee <
    f38f8cce2f7e79775b3db7e8a5eacda04ac908e4
  - Linux 5.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:41:52.574490Z'
published: '2026-08-05'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:44:57.876Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64579'
references:
  - url: 'https://git.kernel.org/stable/c/e48f4c3e3df35b34be719d72d737bbeaca77cf0c'
  - url: 'https://git.kernel.org/stable/c/1cdeed9df1306f1a277e715600772640d63defa9'
  - url: 'https://git.kernel.org/stable/c/43a4d510523779891cf8eca7ffb4a086b0b5d8bf'
  - url: 'https://git.kernel.org/stable/c/d9d9cc21cc90014724a14c447e3d587be9447107'
  - url: 'https://git.kernel.org/stable/c/94c00391a5117530188334f740ce26d3f1256190'
  - url: 'https://git.kernel.org/stable/c/7acc5ed2f33608a3d83b64f50a5766843b6e2485'
  - url: 'https://git.kernel.org/stable/c/6aa3796d18a9fda953ad76a62b57bf6c145cb9ef'
  - url: 'https://git.kernel.org/stable/c/f38f8cce2f7e79775b3db7e8a5eacda04ac908e4'
tags:
  - cve.org
epss: 0.00171
epssPercentile: 0.06493
ingestedAt: '2026-11-06T16:57:43.149Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert

xfrm_hash_rebuild()'s first loop preallocates the bins/chains the reinsert
loop needs, so the reinsert (after hlist_del_rcu()) cannot allocate or
fail. But its guard is inverted: it skips policies with prefixlen <
threshold and preallocates for the rest.

prefixlen < threshold is exactly when policy_hash_bysel() returns NULL and
the reinsert takes the allocating xfrm_policy_inexact_insert() path. So the
loop preallocates for the exact policies (which never allocate) and skips
the inexact ones, whose bin/node is then allocated GFP_ATOMIC during
reinsert. On failure the error path only WARN_ONCE()s and continues,
leaving a poisoned bydst node; the next rebuild's hlist_del_rcu()
dereferences LIST_POISON2 and takes a GPF. Reachable under memory pressure,
deterministic via failslab.

Invert the guard so preallocation covers exactly the reinserted policies;
the reinsert then allocates nothing and cannot fail.

Crash:
  Oops: general protection fault, probably for non-canonical address
  0xfbd59c0000000024: 0000 [#1] SMP KASAN NOPTI
  KASAN: maybe wild-memory-access in range [0xdead...]
  ...
  Workqueue: events xfrm_hash_rebuild
  RIP: 0010:xfrm_hash_rebuild+0x5b3/0x1190
  RAX: dead000000000122   (LIST_POISON2 + offset)
  ...
  Call Trace:
   hlist_del_rcu (include/linux/rculist.h:599)
   xfrm_hash_rebuild (net/xfrm/xfrm_policy.c:1365)
   process_one_work (kernel/workqueue.c:3322)
   worker_thread (kernel/workqueue.c:3486)
   kthread (kernel/kthread.c:436)
   ret_from_fork (arch/x86/kernel/process.c:158)
   ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
   ...
  Kernel panic - not syncing: Fatal exception in interrupt

## Affected

- `Linux >= 24969facd704a5f0dd8e08da86bf32a9ce972bee < e48f4c3e3df35b34be719d72d737bbeaca77cf0c`
- `Linux >= 24969facd704a5f0dd8e08da86bf32a9ce972bee < 1cdeed9df1306f1a277e715600772640d63defa9`
- `Linux >= 24969facd704a5f0dd8e08da86bf32a9ce972bee < 43a4d510523779891cf8eca7ffb4a086b0b5d8bf`
- `Linux >= 24969facd704a5f0dd8e08da86bf32a9ce972bee < d9d9cc21cc90014724a14c447e3d587be9447107`
- `Linux >= 24969facd704a5f0dd8e08da86bf32a9ce972bee < 94c00391a5117530188334f740ce26d3f1256190`
- `Linux >= 24969facd704a5f0dd8e08da86bf32a9ce972bee < 7acc5ed2f33608a3d83b64f50a5766843b6e2485`
- `Linux >= 24969facd704a5f0dd8e08da86bf32a9ce972bee < 6aa3796d18a9fda953ad76a62b57bf6c145cb9ef`
- `Linux >= 24969facd704a5f0dd8e08da86bf32a9ce972bee < f38f8cce2f7e79775b3db7e8a5eacda04ac908e4`
- `Linux 5.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.