Re: [6.12.y] Please backport 8045c0df98d4 ("xfrm: Fix dev use-after-free in xfrm async resumption")

[Greg KH <gregkh@linuxfoundation.org>]

On Fri, Aug 07, 2026 at 04:21:55PM +0200, Matthias Merz wrote:
> Hello,
> 
> Please apply upstream commit 8045c0df98d4 ("xfrm: Fix dev use-after-free
> in xfrm async resumption") also to 6.12.y. Stable 7.1.5 contains this in
> 63a300151999.
> 
> It fixes 1c428b038400 ("xfrm: hold dev ref until after transport_finish
> NF_HOOK"), which is present in 6.12.y since 6.12.94. On our IPsec
> gateways using xfrm interfaces this issue underflows the interface
> refcount and hangs unregister_netdevice() on tunnel teardown, rekey or
> system shutdown:
> 
>   unregister_netdevice: waiting for xfrm-<ifname> to become free. Usage count = -381
> 
> This leads to a complete drop of our VPN links after some hours, and
> stalls the reboot for a couple of minutes waiting for devices to become
> free (I remember waiting 10-15 minutes for the shutdown when remote
> rebooting a gateway without physical access)
> 
> known affected: 6.12.96 and 6.12.96, known unaffected 6.12.90
> Fixed in 7.1.5 via 63a300151999.

It does not apply cleanly to those trees, please provide a working
backport that you have tested and we will be glad to apply it.

thanks,

greg k-h