CVE-2026-64579

A flaw of moderate severity was found in the Linux kernel's xfrm (IPsec) policy subsystem. The preallocation loop in xfrm_hash_rebuild() has an inverted guard: it preallocates for exact-match policies, which never allocate during reinsertion, while skipping the inexact policies whose bins are allocated with GFP_ATOMIC during the reinsert phase. If that allocation fails under memory pressure, the error path only emits a warning and leaves a poisoned bydst list node; the next policy hash rebuild dereferences that poisoned pointer in hlist_del_rcu(), causing a general protection fault and a kernel panic. A local attacker with the ability to create or modify xfrm policies (typically requiring CAP_NET_ADMIN) could exploit this to crash the system, resulting in a denial of service. Red Hat Enterprise Linux 8, 9, and 10 (kernel and kernel-rt) and Red Hat In-Vehicle OS 2 are affected; Red Hat Enterprise Linux 6 and 7 Extended Lifecycle Support are not affected because the vulnerable code is not present in those kernels. Because exploitation is local-only, requires elevated privileges and allocation failure under memory pressure, and the impact is limited to availability, the fix is currently deferred for the affected streams; the residual risk is a local denial of service with no impact on confidentiality or integrity.