CVE-2026-72137

In the Linux kernel, the following vulnerability has been resolved:

xfrm: nat_keepalive: avoid double free on send error

natkeepalivesend() frees the keepalive skb whenever the IPv4 or IPv6

send helper reports an error.

That cleanup is only correct before the skb is handed to the output

path. Once ipbuildandsendpkt() or ip6_xmit() takes ownership, the

networking stack may already have consumed the skb before returning an

error, so freeing it again is unsafe.

Handle the pre-handoff failure cases inside natkeepalivesend_ipv4()

and natkeepalivesend_ipv6(), where the caller still owns the skb, and

keep natkeepalivesend() responsible only for family dispatch and the

unsupported-family cleanup path.