CVE-2026-72463 addresses a use-after-free vulnerability in the Linux kernel's xfrm async resumption mechanism. The vulnerability arises because xfrm async resumption holds a reference count on skb->dev until after transport_finish, but xfrm_rcv_cb may change skb->dev to a tunnel device without taking a device reference. This causes the asynchronous resumption to decrement the tunnel device's reference count improperly, leading to a use-after-free of the tunnel device and a reference count leak on the original device. The fix involves preserving the original skb->dev reference to correct the reference count imbalance and extending RCU protection over the affected code paths to prevent race conditions with device teardown.

This vulnerability can cause use-after-free conditions on tunnel network devices and reference count leaks on original devices in the Linux kernel. Such conditions may lead to kernel instability or crashes due to improper device memory management. There is no indication of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability has been resolved in the Linux kernel source, but no explicit patch links or vendor advisories are provided in this data. Users should monitor official Linux kernel releases and apply updates when available.