In the Linux kernel

CVE-2026-72137 is a double-free in the Linux kernel's xfrm subsystem, specifically in nat_keepalive_send(). When the IPv4/IPv6 send helper returns an error, the function frees the skb (socket buffer) a second time — the networking stack already consumed and freed it. This creates a classic use-after-free / double-free primitive that, with careful heap grooming, yields kernel-mode code execution and root privilege escalation. The bug was introduced in commit f531d13bdfe3 (June 2024) and affects kernels from 6.11 through pre-fix. Upstream fixes landed in July 2026 and are available in stable branches 6.12.101, 6.18.40, 7.1.5, and 7.2-rc4. Red Hat Enterprise Linux 6–9 is not affected because RHEL never shipped kernel 6.11+.

The vendor (NVD) severity of CVSS 9.8 CRITICAL with AV:N is flatly wrong. This is a local privilege escalation — the attacker must already have shell access on the target host. Red Hat independently rescored it as 7.0 HIGH with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, and that assessment is far more accurate. The AC:H reflects the heap manipulation required to weaponize a double-free, and AV:L correctly captures that no network-only attack path exists. The NVD 9.8 likely resulted from automated scoring that conflated the xfrm *networking* subsystem with a network attack vector — a common error for kernel CVEs in packet-handling code.

Why this verdict

• NVD AV:N is wrong: The double-free is in nat_keepalive_send(), a kernel-internal function. Exploitation requires local shell access. Red Hat correctly assigned AV:L. This single correction drops the CVSS from 9.8 to the 7.x range.
• AC:H is justified: Weaponizing a kernel double-free requires heap grooming, KASLR bypass, and precise timing. The NebuSec PoC works on a specific Ubuntu build; porting requires non-trivial kernel internals knowledge.
• Narrow affected population: Only kernels 6.11+ are vulnerable. RHEL (the dominant enterprise distro) is entirely unaffected. Exposure is concentrated on Ubuntu 24.10+, Fedora 41+, and rolling-release distros — a minority of enterprise fleets.
• xfrm prerequisite narrows further: The vulnerable code path requires IPsec NAT-T keepalive to be active or user-namespace xfrm access. Most Linux servers do not terminate IPsec tunnels.
• Role multiplier: The Linux kernel is the affected component, and kernel LPE is universally impactful regardless of host role. On VPN gateways (StrongSwan/Libreswan hosts where xfrm is *guaranteed* to be active), the chain both succeeds more reliably AND yields network-edge control — blast radius extends to all traffic traversing the gateway. On Kubernetes nodes, root = container escape = cluster compromise. On KVM hypervisors, root = guest VM access. These high-value roles keep the floor at HIGH despite the friction. However, <10% of the installed base of affected kernels occupies these roles, and the xfrm prerequisite already aligns with VPN gateway use, so the floor does not rise to CRITICAL.

Why not higher?

CRITICAL would require either a network-reachable attack vector or a scenario where the majority of affected hosts are high-value targets. Neither applies: the bug requires local access (post-compromise), RHEL is unaffected, and the xfrm/IPsec prerequisite limits the reliably exploitable population to VPN gateways and hosts with user namespaces. No wild exploitation exists, and the PoC is tied to a single Ubuntu build.

Why not lower?

A public PoC demonstrating root escalation exists, the kernel is the most privileged software on any host, and the affected component (xfrm) is *definitionally* active on VPN gateways — meaning the hosts where this bug is most exploitable are also the highest-value targets. MEDIUM would understate the risk for any fleet running StrongSwan/Libreswan on modern kernels.

1. Restrict user namespaces on affected hosts — Set kernel.unprivileged_userns_clone=0 (sysctl) or apply AppArmor/SELinux restrictions to block unprivileged xfrm state creation. This eliminates the most common path for an unprivileged attacker to reach the vulnerable code. Deploy within 30 days per the noisgate mitigation SLA for HIGH.
2. Audit and isolate IPsec-terminating hosts — Identify all hosts running StrongSwan, Libreswan, or custom IPsec with NAT-T enabled. These are the highest-risk targets. Prioritize kernel patching on these hosts first. If patching is delayed, restrict local shell access to these systems to essential administrators only.
3. Enable KASAN in non-production kernels — Kernel Address Sanitizer will immediately detect and halt double-free exploitation attempts. Not suitable for production due to performance overhead, but valuable for detecting exploitation in staging/test environments.
4. Monitor for anomalous xfrm netlink messages — Use auditd rules to log XFRM_MSG_NEWSA and XFRM_MSG_NEWPOLICY from non-root, non-IPsec-daemon processes. Any unprivileged process creating xfrm states is suspicious and warrants investigation.

Run this script on each target Linux host as root (or with sudo). Invoke with: sudo bash check_cve_2026_72137.sh. It checks kernel version against known-fixed versions and whether xfrm NAT-T keepalive is actively in use.

#!/bin/bash
# CVE-2026-72137 Checker — xfrm nat_keepalive double-free
# Run as root on target Linux hosts
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

KERNEL=$(uname -r)
VERSION=$(echo "$KERNEL" | grep -oP '^[0-9]+\.[0-9]+\.[0-9]+')

if [ -z "$VERSION" ]; then
  echo "UNKNOWN — could not parse kernel version from: $KERNEL"
  exit 2
fi

MAJOR=$(echo "$VERSION" | cut -d. -f1)
MINOR=$(echo "$VERSION" | cut -d. -f2)
PATCH=$(echo "$VERSION" | cut -d. -f3)

# Check if this is a RHEL/CentOS kernel (not affected)
if [ -f /etc/redhat-release ] && rpm -q kernel 2>/dev/null | grep -qP 'el[6-9]'; then
  echo "PATCHED — RHEL/CentOS kernel detected; CVE-2026-72137 does not affect RHEL-shipped kernels."
  exit 0
fi

# Vulnerable range: 6.11.0 through pre-fix
# Fixed in: 6.12.101+, 6.18.40+, 7.1.5+, 7.2+
VULNERABLE=0

if [ "$MAJOR" -lt 6 ]; then
  echo "PATCHED — kernel $VERSION predates vulnerable code (introduced in 6.11)."
  exit 0
elif [ "$MAJOR" -eq 6 ] && [ "$MINOR" -lt 11 ]; then
  echo "PATCHED — kernel $VERSION predates vulnerable code (introduced in 6.11)."
  exit 0
elif [ "$MAJOR" -eq 6 ] && [ "$MINOR" -eq 12 ] && [ "$PATCH" -ge 101 ]; then
  echo "PATCHED — kernel $VERSION includes fix (6.12.101+)."
  exit 0
elif [ "$MAJOR" -eq 6 ] && [ "$MINOR" -eq 18 ] && [ "$PATCH" -ge 40 ]; then
  echo "PATCHED — kernel $VERSION includes fix (6.18.40+)."
  exit 0
elif [ "$MAJOR" -eq 7 ] && [ "$MINOR" -eq 1 ] && [ "$PATCH" -ge 5 ]; then
  echo "PATCHED — kernel $VERSION includes fix (7.1.5+)."
  exit 0
elif [ "$MAJOR" -eq 7 ] && [ "$MINOR" -ge 2 ]; then
  echo "PATCHED — kernel $VERSION includes fix (7.2+)."
  exit 0
elif [ "$MAJOR" -gt 7 ]; then
  echo "PATCHED — kernel $VERSION is beyond affected range."
  exit 0
else
  VULNERABLE=1
fi

# Check if xfrm NAT-T keepalive is active (increases risk)
XFRM_ACTIVE="no"
if ip xfrm state 2>/dev/null | grep -q 'encap type espinudp'; then
  XFRM_ACTIVE="yes"
fi

if [ "$VULNERABLE" -eq 1 ]; then
  echo "VULNERABLE — kernel $VERSION is in the affected range (6.11 to pre-fix)."
  echo "  xfrm NAT-T active: $XFRM_ACTIVE"
  if [ "$XFRM_ACTIVE" = "yes" ]; then
    echo "  WARNING: IPsec NAT-T is active — this host is at elevated risk."
  fi
  exit 1
fi

echo "UNKNOWN — could not determine patch status for kernel $VERSION."
exit 2

Sources

1. CVE Record — CVE-2026-72137
2. Red Hat CVE Page — CVE-2026-72137
3. SecurityOnline — CVE-2026-72137 LPE Analysis
4. CyberSecurityNews — Linux Kernel Double-Free Vulnerability
5. CVEMon — CVE-2026-72137 Overview
6. Red Hat Errata — RHSA-2026:42919
7. GreyNoise — Vulnerability Exploitation Patterns