DEBIAN-CVE-2026-72137

In the Linux kernel, the following vulnerability has been resolved:  xfrm: natkeepalive: avoid double free on send error  natkeepalivesend() frees the keepalive skb whenever the IPv4 or IPv6 send helper reports an error.  That cleanup is only correct before the skb is handed to the output path. Once ipbuildandsendpkt() or ip6xmit() takes ownership, the networking stack may already have consumed the skb before returning an error, so freeing it again is unsafe.  Handle the pre-handoff failure cases inside natkeepalivesendipv4() and natkeepalivesendipv6(), where the caller still owns the skb, and keep natkeepalivesend() responsible only for family dispatch and the unsupported-family cleanup path.