In the Linux kernel, the following vulnerability has been resolved:
xfrm: nat_keepalive: avoid double free on send error
nat_keepalive_send() frees the keepalive skb whenever the IPv4 or IPv6 send helper reports an error.
That cleanup is only correct before the skb is handed to the output path. Once ip_build_and_send_pkt() or ip6_xmit() takes ownership, the networking stack may already have consumed the skb before returning an error, so freeing it again is unsafe.
Handle the pre-handoff failure cases inside nat_keepalive_send_ipv4() and nat_keepalive_send_ipv6(), where the caller still owns the skb, and keep nat_keepalive_send() responsible only for family dispatch and the unsupported-family cleanup path.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel6.12-headersUpgrade kernel6.12-debuginfoUpgrade python3-perf6.12Upgrade kernel6.12-tools-debuginfoUpgrade kernel6.12-toolsUpgrade kernel6.12-debuginfo-common-x86_64Upgrade kernel6.12-debuginfo-common-aarch64Upgrade python3-perf6.12-debuginfoUpgrade kernel6.12-tools-develUpgrade kernel6.12-modules-extra-commonUpgrade perf6.12Upgrade bpftool6.12Upgrade kernel6.12-develUpgrade bpftool6.12-debuginfoUpgrade perf6.12-debuginfoUpgrade kernel6.12Upgrade kernel-livepatch-6.12.103-127.188Upgrade kernel6.12-modules-extra | Sep 1, 2026 | Aug 15, 2026 |
| Debian | — | Upgrade linux-6.12Upgrade linux | Aug 16, 2026 | Aug 16, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Aug 25, 2026 | Aug 15, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub