{"id":"CVE-2026-98364","published":"2026-10-06T09:18:30.547","lastModified":"2026-10-07T07:17:10.717","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: hold net_device reference under RCU in bundle creation\n\nxfrm_bundle_create() and xfrm_create_dummy_bundle() read dst->dev into\na local pointer without taking a device reference, then pass it to\nxfrm_fill_dst(). A concurrent RTM_DELLINK replaces dst->dev via\ndst_dev_put() and frees the old net_device, causing a use-after-free\nwhen xfrm6_fill_dst() later dereferences the stale dev pointer.\n\n  BUG: KASAN: slab-use-after-free in xfrm6_fill_dst+0x82c/0x860\n  (net/ipv6/xfrm6_policy.c:86 netdev_hold())\n  Read of size 8 at addr ffff8880142fe588 by task exploit/153\n  Call Trace:\n   xfrm6_fill_dst+0x82c/0x860\n   xfrm_resolve_and_create_bundle+0x21d4/0x2bd0\n   xfrm_lookup_with_ifid+0x485/0x1640\n   ip6_dst_lookup_flow+0x19b/0x1e0\n   udpv6_sendmsg+0x1443/0x2dd0\n\nFix this by reading dst->dev via dst_dev_rcu() and keeping the RCU\nread-side critical section active until xfrm_fill_dst() has taken the\nrequired device references.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/8d85d6bc9c46dc41cb2be0eac53f8ab068c3a807","tags":[]},{"url":"https://git.kernel.org/stable/c/9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Linux kernel's IPsec implementation has a use-after-free vulnerability in the XFRM subsystem where network device references are not properly held under RCU during bundle creation, potentially allowing attackers to corrupt memory or execute code when concurrent network interface removal occurs.","exploitability":"Exploitation requires a specific timing window where a network interface is concurrently removed while an IPsec policy lookup is in progress, making it moderately difficult but possible with careful crafting of network traffic patterns.","blast_radius":"The vulnerability affects systems running Linux kernels with IPsec enabled and active policies, potentially leading to kernel memory corruption that could result in system instability or privilege escalation.","remediation":"Apply the kernel patch that resolves the xfrm use-after-free issue in the net/ipv6/xfrm6_policy.c file by upgrading to a kernel version that includes this fix, specifically targeting kernels with the fix for CVE-2026-98364.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["kernel","ipsec","memory-corruption","network"],"model":"garnet-coder","analyzedAt":"2026-10-14T09:02:41.647Z"}}