CVE-2026-63919: Linux

High severity, CVSS 8.8. EPSS: 0.7% chance of exploitation in the next 30 days.

In the Linux kernel, the following vulnerability has been resolved: xfrm: input: hold netns during deferred transport reinjection Transport-mode reinjection stores a struct net pointer in skb->cb and uses it later from xfrm_trans_reinject(). That pointer must stay valid until the deferred callback runs. Take a netns reference when queueing deferred reinjection work and drop it after the callback completes. Use maybe_get_net() so the queueing path does not revive a namespace that is already being torn down. This keeps the existing workqueue design and fixes the netns lifetime handling in one place for all users of xfrm_trans_queue_net().

Affected products

• Linux Linux: from 5.6, before 5.10.259 (fixed in 5.10.259); from 5.11, before 5.15.210 (fixed in 5.15.210); from 5.16, before 6.1.176 (fixed in 6.1.176); from 6.2, before 6.6.143 (fixed in 6.6.143); from 6.7, before 6.12.93 (fixed in 6.12.93); from 6.13, before 6.18.35 (fixed in 6.18.35); …

Published 2026-07-19. Last modified 2026-07-27.