CVE-2026-64579: xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert

CVE-2026-64579: xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert

xfrm_hash_rebuild()'s first loop preallocates the bins/chains the reinsert
loop needs, so the reinsert (after hlist_del_rcu()) cannot allocate or
fail. But its guard is inverted: it skips policies with prefixlen <
threshold and preallocates for the rest.

prefixlen < threshold is exactly when policy_hash_bysel() returns NULL and
the reinsert takes the allocating xfrm_policy_inexact_insert() path. So the
loop preallocates for the exact policies (which never allocate) and skips
the inexact ones, whose bin/node is then allocated GFP_ATOMIC during
reinsert. On failure the error path only WARN_ONCE()s and continues,
leaving a poisoned bydst node; the next rebuild's hlist_del_rcu()
dereferences LIST_POISON2 and takes a GPF. Reachable under memory pressure,
deterministic via failslab.

Invert the guard so preallocation covers exactly the reinserted policies;
the reinsert then allocates nothing and cannot fail.

Crash:
  Oops: general protection fault, probably for non-canonical address
  0xfbd59c0000000024: 0000 [#1] SMP KASAN NOPTI
  KASAN: maybe wild-memory-access in range [0xdead...]
  ...
  Workqueue: events xfrm_hash_rebuild
  RIP: 0010:xfrm_hash_rebuild+0x5b3/0x1190
  RAX: dead000000000122   (LIST_POISON2 + offset)
  ...
  Call Trace:
   hlist_del_rcu (include/linux/rculist.h:599)
   xfrm_hash_rebuild (net/xfrm/xfrm_policy.c:1365)
   process_one_work (kernel/workqueue.c:3322)
   worker_thread (kernel/workqueue.c:3486)
   kthread (kernel/kthread.c:436)
   ret_from_fork (arch/x86/kernel/process.c:158)
   ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
   ...
  Kernel panic - not syncing: Fatal exception in interrupt

The Linux kernel CVE team has assigned CVE-2026-64579 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.0 with commit 24969facd704a5f0dd8e08da86bf32a9ce972bee and fixed in 6.6.148 with commit d9d9cc21cc90014724a14c447e3d587be9447107
	Issue introduced in 5.0 with commit 24969facd704a5f0dd8e08da86bf32a9ce972bee and fixed in 6.12.101 with commit 94c00391a5117530188334f740ce26d3f1256190
	Issue introduced in 5.0 with commit 24969facd704a5f0dd8e08da86bf32a9ce972bee and fixed in 6.18.42 with commit 7acc5ed2f33608a3d83b64f50a5766843b6e2485
	Issue introduced in 5.0 with commit 24969facd704a5f0dd8e08da86bf32a9ce972bee and fixed in 7.1.6 with commit 6aa3796d18a9fda953ad76a62b57bf6c145cb9ef
	Issue introduced in 5.0 with commit 24969facd704a5f0dd8e08da86bf32a9ce972bee and fixed in 7.2-rc4 with commit f38f8cce2f7e79775b3db7e8a5eacda04ac908e4

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64579
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/xfrm/xfrm_policy.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/d9d9cc21cc90014724a14c447e3d587be9447107
	https://git.kernel.org/stable/c/94c00391a5117530188334f740ce26d3f1256190
	https://git.kernel.org/stable/c/7acc5ed2f33608a3d83b64f50a5766843b6e2485
	https://git.kernel.org/stable/c/6aa3796d18a9fda953ad76a62b57bf6c145cb9ef
	https://git.kernel.org/stable/c/f38f8cce2f7e79775b3db7e8a5eacda04ac908e4