OSG-SEC-2026-09-02 Important-Linux Kernel XFRM NAT Keepalive LPE

Dear OSG Security Contacts,

A vulnerability, CVE-2026-72137, has been identified in the Linux kernel XFRM NAT-keepalive implementation. Successful exploitation may cause kernel memory corruption and potentially allow a local attacker to escalate privileges.

WHAT IS THE VULNERABILITY:

The Linux XFRM subsystem is the kernel framework for packet transformations and provides underlying functionality used by protocols such as IPsec. CVE-2026-72137 is a double-free vulnerability in the Linux kernel XFRM NAT-keepalive implementation. Under certain error conditions, a network packet buffer (skb) may be freed by the networking stack and subsequently freed again by the XFRM NAT-keepalive code, potentially resulting in kernel memory corruption. A public local privilege-escalation (LPE) exploit is available [2] and specifically targets Ubuntu 26.04 with kernel 7.0.0-28. At this time, we are not aware of a publicly available exploit specifically demonstrating successful exploitation against RHEL 10.

IMPACTED VERSIONS:

This issue does not affect the versions of the kernel as shipped with Red Hat Enterprise Linux 6, 7, 8, and 9, as the vulnerable xfrm NAT keepalive code was introduced in Linux 6.11 [1].

RHEL 10: Sites should check Red Hat's current product/package status for CVE-2026-72137 and apply applicable security updates.

Other distributions or systems using newer/upstream kernels should consult their vendor's security advisory.

The upstream vulnerability has been fixed in kernel versions 6.12.101, 6.18.40, 7.1.5, and 7.2-rc4 [1].

For RHEL systems, the upstream kernel version should not be used alone to determine vulnerability status. Red Hat may backport security fixes into its distribution kernel packages while retaining an earlier upstream base version.

MITIGATION

The published Ubuntu exploit [2] explicitly creates user and network namespaces and configures the vulnerable XFRM NAT-keepalive state within the new network namespace. Restricting unprivileged user-namespace and/or network-namespace creation may therefore reduce exposure to this published exploitation technique [4][5]. Red Hat's published mitigation is to update to a fixed kernel and does not provide specific guidance on namespace or XFRM restrictions.

WHAT YOU SHOULD DO:

Apply the applicable kernel security update,if necessary, and reboot any affected systems and verify that the fixed kernel is running. Where immediate patching is not possible, consider restricting unprivileged user namespace [5] and/or network namespace creation [4] after assessing potential operational impact. These measures may reduce exposure to the published exploitation technique but should not be considered a substitute for patching.

REFERENCES

[1] https://access.redhat.com/security/cve/cve-2026-72137
[2] https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-72137-ubuntu-7.0.0-28
[3] https://ubuntu.com/security/CVE-2026-72137
[4] https://apptainer.org/docs/admin/latest/user_namespace.html#disabling-network-namespaces.
[5] https://access.redhat.com/security/vulnerabilities/RHSB-2026-009