All vulnerabilities
CVE-2026-98364

Linux: xfrm: hold net_device reference under RCU in bundle creation

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
7.8High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.12%Chance of exploitation activity in the next 30 days, higher than 1% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in8d85d6bc9c46dc41cb2be0eac53f8ab068c3a807Also 9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1CVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 8d85d6bc9c46dc41cb2be0eac53f8ab068c3a807LinuxCVE List
  • 9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: hold net_device reference under RCU in bundle creation

xfrm_bundle_create() and xfrm_create_dummy_bundle() read dst->dev into a local pointer without taking a device reference, then pass it to xfrm_fill_dst(). A concurrent RTM_DELLINK replaces dst->dev via dst_dev_put() and frees the old net_device, causing a use-after-free when xfrm6_fill_dst() later dereferences the stale dev pointer.

BUG: KASAN: slab-use-after-free in xfrm6_fill_dst+0x82c/0x860 (net/ipv6/xfrm6_policy.c:86 netdev_hold()) Read of size 8 at addr ffff8880142fe588 by task exploit/153 Call Trace: xfrm6_fill_dst+0x82c/0x860 xfrm_resolve_and_create_bundle+0x21d4/0x2bd0 xfrm_lookup_with_ifid+0x485/0x1640 ip6_dst_lookup_flow+0x19b/0x1e0 udpv6_sendmsg+0x1443/0x2dd0

Fix this by reading dst->dev via dst_dev_rcu() and keeping the RCU read-side critical section active until xfrm_fill_dst() has taken the required device references.

Text from CVE List

Affected versions 6

  • Linuxaffected: 25ee3286dcbc830a833354bb1d15567956844813 before 8d85d6bc9c46dc41cb2be0eac53f8ab068c3a807CVE List
  • Linuxaffected: 25ee3286dcbc830a833354bb1d15567956844813 before 9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1CVE List
  • Linuxaffected: 2.6.25CVE List
  • Linuxunaffected: all versions before 2.6.25CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 2