diff --git a/private/dumpstate.te b/private/dumpstate.te
index b98cb97..8cdf3cc 100644
--- a/private/dumpstate.te
+++ b/private/dumpstate.te
@@ -517,7 +517,12 @@
 binder_call(dumpstate, installd);
 
 # Allow dumpstate to run ip xfrm policy
-allow dumpstate self:netlink_xfrm_socket { create_socket_perms_no_ioctl nlmsg_read };
+allow dumpstate self:netlink_xfrm_socket create_socket_perms_no_ioctl;
+# For kernel < 6.13
+allow dumpstate self:netlink_xfrm_socket nlmsg_read;
+# For kernel >= 6.13
+allow dumpstate self:netlink_xfrm_socket nlmsg;
+allowxperm dumpstate self:netlink_xfrm_socket nlmsg XFRM_MSG_GETPOLICY;
 
 # Allow dumpstate to run iotop
 allow dumpstate self:netlink_socket create_socket_perms_no_ioctl;