External risk intelligence

Linux Kernel xfrm NAT Keepalive Double Free Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72137

This vulnerability exists within internal Linux kernel networking functions related to XFRM (IPsec) NAT keepalive mechanisms. These operations occur deep within the kernel stack during packet processing rather than at an interface exposed to the public internet, making direct remote exploitation of this specific code path via typical network services extremely unlikely.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the Linux kernel's network handling could allow for a double free error during packet sending, potentially leading to system instability. While the immediate risk is low due to its internal nature, confirming relevance is key.

Kernel network issue could cause system instability.
Important for ensuring system integrity and stability.
Confirm relevance and exposure within your environment.

Attack Path

How an attacker could exploit the issue

An attacker could potentially trigger a double-free condition within the Linux kernel's networking stack by exploiting an error in how keepalive packets are handled. This occurs when network transmission fails, and the system attempts to free memory for the packet twice, which could lead to a crash or other unpredictable behavior.

Entry condition: Network packet processing.
Trigger point: Sending a keepalive packet fails.
Resulting risk: System instability or crash.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability involves a potential double-free error within the Linux kernel's network packet handling for NAT keepalive messages. Under specific error conditions during packet sending, the kernel could attempt to free memory that has already been freed, which may lead to system instability or unexpected behavior. This issue is confined to internal kernel operations and does not directly expose user data or sensitive information.

Kernel memory integrity.
Error during packet send processing.
Potential system instability.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides within the Linux kernel's XFRM (IPsec) NAT keepalive functionality. Action is likely required by infrastructure or platform teams responsible for managing the kernel. The first step is to identify systems running the affected kernel version, assess their exposure, and confirm ownership to prioritize remediation efforts.

Infrastructure or platform teams own this.
Verify affected kernel instances and exposure.
Plan kernel updates or relevant security hardening.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel XFRM component?

XFRM is the framework within the Linux kernel that handles IPsec transformations. It is used to provide security services like encryption, authentication, and tunneling for network traffic. In this context, it specifically manages NAT keepalive packets, which are small signals sent to ensure that VPN or encrypted network connections remain active even when passing through firewalls or routers that perform network address translation.

How does CVE-2026-72137 cause a double free error?

This vulnerability is a memory management flaw known as a double free. It happens when the kernel attempts to release the memory allocated for a network packet twice. In this specific case, the error occurs because the system mistakenly frees a packet during a failed transmission attempt, even if the networking stack has already taken ownership and disposed of it. This discrepancy in tracking who owns the memory leads to the error.

Do I need to trigger a packet error to be affected?

Yes, the issue is not triggered by standard, successful network traffic. The vulnerability only manifests when a specific failure occurs during the transmission of an IPsec NAT keepalive packet. If the send operation succeeds, or if the kernel code path does not encounter this specific error condition, the double free behavior will not occur.

Is CVE-2026-72137 reachable from the internet?

According to Halo Surface Signal, direct remote exploitation is very unlikely. This bug exists deep within internal kernel networking functions rather than at a public-facing interface. Because it operates within the XFRM subsystem for IPsec maintenance, it is not readily accessible to external actors through standard network services, limiting the practical risk for most systems.

When should I prioritize a fix for this kernel issue?

You should prioritize this if you manage infrastructure running Linux kernels that utilize IPsec/XFRM features. Because this is a kernel-level memory issue, the primary response is to identify affected systems and plan for a standard kernel update. Coordinate with your platform or infrastructure team to confirm your specific kernel version and prepare to apply the necessary patches provided by your Linux distribution maintainers.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.