External risk intelligence

Linux Kernel xfrm Race Condition in State Cache Insertion

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-72451

This vulnerability exists in the Linux kernel's xfrm (IPsec) state management code. It is an internal kernel-level race condition affecting packet processing logic. It is not an internet-facing service or application, and it does not provide an external network interface that is directly reachable or exploitable from the public internet.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory addresses a resolved vulnerability within the Linux kernel related to the handling of security states during network packet processing. While the issue has been fixed, it highlights a race condition that could have potentially impacted the integrity of security data. The main concern is confirming whether this specific internal kernel function is relevant to our operational environment.

Security state handling flaw in Linux kernel.
Concerns packet integrity, requires internal validation.
Confirm relevance and exposure to Linux systems.

Attack Path

How an attacker could exploit the issue

An attacker could exploit a race condition in the Linux kernel's xfrm state cache. If an attacker can trigger a specific timing where a state is validated but then removed before being inserted into the cache, they could cause a vulnerable state to be added. This could potentially lead to integrity and confidentiality issues within the kernel.

No special access needed.
Race condition during state insertion.
Kernel integrity and confidentiality risk.

Live Threat

Current exploitation, exposure, and threat context

A race condition in the Linux kernel's xfrm state cache insertion could allow for a "dead state" to be added to the cache, potentially impacting network packet processing when supported by the advisory.

Kernel state data may be affected.
A race condition could insert invalid states.
Network packet processing could be disrupted.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Linux kernel's xfrm subsystem is affected by a race condition during state cache insertion. This vulnerability could be exploited by an unauthenticated, remote attacker to cause denial of service or potentially compromise system integrity. Initial triage should focus on identifying all systems running the affected Linux kernel versions, assessing their exposure to network-based attacks, and confirming ownership with the relevant infrastructure or platform teams to plan remediation.

Identify affected Linux kernel systems.
Verify network exposure and business criticality.
Plan remediation with infrastructure owners.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux xfrm subsystem affected by CVE-2026-72451?

The xfrm subsystem is a core part of the Linux kernel responsible for implementing IPsec (Internet Protocol Security). It manages the transformations—such as encryption, decryption, and authentication—applied to network packets to secure data transmitted between systems or across networks.

What does this race condition mean for the Linux kernel?

This vulnerability involves a timing error where the kernel checks if a security state is valid but fails to account for that state being deleted by another process immediately afterward. This creates a window where a 'dead' or invalid state can be mistakenly added to the system cache, potentially causing inconsistent security enforcement.

How is this race condition triggered?

The flaw is triggered during the kernel's network packet processing path. It requires a specific sequence of events where a state is validated just before it is removed by a competing process. Simply sending standard network traffic does not necessarily trigger the bug, as it requires precise timing between these internal kernel operations.

Do I need to worry about external threats for this CVE?

According to Halo Surface Signal, this vulnerability exists deep within kernel-level code and does not expose an internet-facing service. Because it is an internal processing issue rather than a reachable network interface, the likelihood of remote, internet-based exploitation is considered very unlikely.

When should I prioritize fixing CVE-2026-72451?

Prioritize this based on your organization's patch management policy for kernel-level updates. Start by inventorying systems running the affected Linux kernel versions and coordinating with your infrastructure teams to verify if your specific network configurations utilize the xfrm subsystem, which is necessary for the bug to exist.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.