SECUFOCUSNOW
Home›CVE index›CVE-2026-46116
Review reviewHigh

CVE-2026-46116

Linux Linux, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support

In the Linux kernel, the following vulnerability has been resolved: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete KASAN reproduces a slab-use-after-free in __xfrm_state_delete()'s hlist_del_rcu calls under syzkaller load on linux-6.12.y stable (reproduced on 6.12.47, also reachable via the same code path on torvalds/master and on the ipsec tree). Nine unique signatures cluster in the xfrm_state lifecycle, the load-bearing one being: BUG: KASAN: slab-use-after-free in __hlist_del include/linux/list.h:990 [inline] BUG: KASAN: slab-use-after-free in hlist_del_rcu include/lin...

CVSS
7.8
EPSS
0.13%
3.01% percentile
CISA KEV
Not listed
Published
2026.05.28
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.13%
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete KASAN reproduces a slab-use-after-free in __xfrm_state_delete()'s hlist_del_rcu calls under syzkaller load on linux-6.12.y stable (reproduced on 6.12.47, also reachable via the same code path on torvalds/master and on the ipsec tree). Nine unique signatures cluster in the xfrm_state lifecycle, the load-bearing one being: BUG: KASAN: slab-use-after-free in __hlist_del include/linux/list.h:990 [inline] BUG: KASAN: slab-use-after-free in hlist_del_rcu include/lin...

Affected product and versions

Product
Linux Linux, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support
Affected versions
>= 7b4dc3600e4877178ba94c7fbf7e520421378aa6 < 6b4dc3181b4bfc5f5fc33ab33b1dc6e15759f4b6, >= 7b4dc3600e4877178ba94c7fbf7e520421378aa6 < 3943fcad7694a7d0b15aeabe7d3cc2a2eb8e92e8, >= 7b4dc3600e4877178ba94c7fbf7e520421378aa6 < 2c617848ae6e4f07a3e397f604208c293bbecacc, >= 7b4dc3600e4877178ba94c7fbf7e520421378aa6 < b4a53add2fa8f1b5aa17d4c5686c320785fab182, >= 7b4dc3600e4877178ba94c7fbf7e520421378aa6 < 26edb0a3c99f9d958c212be68b21f1221614dcf0, >= 7b4dc3600e4877178ba94c7fbf7e520421378aa6 < 4980162de555cb838f1a189ce7d2cbf5d2e7b050, >= 7b4dc3600e4877178ba94c7fbf7e520421378aa6 < a2e2d08fb070fab4947447171f1c4e3ca5a188e5, >= 7b4dc3600e4877178ba94c7fbf7e520421378aa6 < 14acf9652e5690de3c7486c6db5fb8dafd0a32a3, >= 2.6.19, >= 2.6.19 < 5.15.210, >= 5.16 < 6.1.176, >= 6.2 < 6.6.140, >= 6.7 < 6.12.88, >= 6.13 < 6.18.30, >= 6.19 < 7.0.7, 7.1
Fixed versions
5.15.210, 6.1.176, 6.6.140, 6.12.88, 6.18.30, 7.0.7

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-416, CWE-763