CVE-2026-64580: xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()

On the error path where in6_dev_get(dev) returns NULL, xfrm6_fill_dst()
releases the device reference with netdev_put() but leaves
xdst->u.dst.dev set. dst_destroy() later calls netdev_put(dst->dev)
again, so the same net_device reference is released twice, underflowing
its refcount (ref_tracker WARNING + "unregister_netdevice: waiting for
<dev> to become free").

Clear xdst->u.dst.dev after the netdev_put(), the same way the XFRM
device-offload paths xfrm_dev_state_add() and xfrm_dev_policy_add() in
net/xfrm/xfrm_device.c NULL ->dev when releasing the reference on error.

  ref_tracker: reference already released.
  ref_tracker: allocated in:
   xfrm6_fill_dst (net/ipv6/xfrm6_policy.c:86)
   ...
   udpv6_sendmsg (net/ipv6/udp.c:1696)
   ...
  ref_tracker: freed in:
   xfrm6_fill_dst (net/ipv6/xfrm6_policy.c:90)
   ...
  WARNING: lib/ref_tracker.c:322 at ref_tracker_free+0x58b/0x780
   dst_destroy (net/core/dst.c:115)
   rcu_core
   handle_softirqs
   ...

The Linux kernel CVE team has assigned CVE-2026-64580 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.10 with commit 84c4a9dfbf430861e7588d95ae3ff61535dca351 and fixed in 6.6.148 with commit df6856c2dda9187601d29b5fbd7a81b3b178cedf
	Issue introduced in 3.10 with commit 84c4a9dfbf430861e7588d95ae3ff61535dca351 and fixed in 6.12.101 with commit 43de8a49335e611adb271bbd52e84dfbc11fc185
	Issue introduced in 3.10 with commit 84c4a9dfbf430861e7588d95ae3ff61535dca351 and fixed in 6.18.42 with commit ff636d7b7cba6dea82ecf580415ea57f2c1a11b6
	Issue introduced in 3.10 with commit 84c4a9dfbf430861e7588d95ae3ff61535dca351 and fixed in 7.1.6 with commit e078da1b4e11390cff3201c19a9a1fe70c5b934f
	Issue introduced in 3.10 with commit 84c4a9dfbf430861e7588d95ae3ff61535dca351 and fixed in 7.2-rc4 with commit 136992de9bb91871084ae52d172610541c76e4d2
	Issue introduced in 3.0.79 with commit a7e22d0c0e81dde129a51ee413644124f4b59954
	Issue introduced in 3.2.46 with commit 01b0d887f67a388fb2a658ee2bdd74e5ba146818
	Issue introduced in 3.4.46 with commit a98124aac0b5adc5de8ae54f11322781cb4d85c3
	Issue introduced in 3.9.3 with commit e27b7bee743d921f037b1da6f071237345bef7c1

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64580
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/ipv6/xfrm6_policy.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/df6856c2dda9187601d29b5fbd7a81b3b178cedf
	https://git.kernel.org/stable/c/43de8a49335e611adb271bbd52e84dfbc11fc185
	https://git.kernel.org/stable/c/ff636d7b7cba6dea82ecf580415ea57f2c1a11b6
	https://git.kernel.org/stable/c/e078da1b4e11390cff3201c19a9a1fe70c5b934f
	https://git.kernel.org/stable/c/136992de9bb91871084ae52d172610541c76e4d2