All vulnerabilities
CVE-2026-98370

Linux: xfrm: fix compat ALLOCSPI request use-after-free

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.17%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in494f2bee9d8d0ebcfa249ac41bed7fed26d119b4Also 17893987e52918c23945c42e47e894a936305a25, 42971ea17c7a8afc0bdd5ca40648bf4e5bb7b810 and 2 moreCVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 494f2bee9d8d0ebcfa249ac41bed7fed26d119b4LinuxCVE List
  • 17893987e52918c23945c42e47e894a936305a25LinuxCVE List
  • 42971ea17c7a8afc0bdd5ca40648bf4e5bb7b810LinuxCVE List
  • 2b63341e2ebc9b6f73cbd9214dbe7d46dd98c718LinuxCVE List
  • 248433942155b42a0ef04a5806c8aca024ea7c33LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: fix compat ALLOCSPI request use-after-free

xfrm_state_netlink() builds the ALLOCSPI response with dump_one_state(), which already calls alloc_compat() with the response skb and header.

xfrm_alloc_userspi() then calls alloc_compat() again, but passes the original request skb and its header. For a compat request, the translator therefore interprets the 228-byte compat xfrm_userspi_info as the 232-byte native layout and reads four bytes past the declared payload. It also publishes the translated child through the request's frag_list.

A multicast clone of the request shares skb_shared_info and can observe that child. xfrm_user_rcv_msg() frees it after the request handler returns, racing a compat receiver which may still be copying from it and resulting in a use-after-free.

Remove the redundant conversion. The response keeps its correct compat translation from dump_one_state(), and no child is attached to the inbound request.

Text from CVE List

Affected versions 18

  • Linuxaffected: 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 before 494f2bee9d8d0ebcfa249ac41bed7fed26d119b4CVE List
  • Linuxaffected: 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 before 17893987e52918c23945c42e47e894a936305a25CVE List
  • Linuxaffected: 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 before 42971ea17c7a8afc0bdd5ca40648bf4e5bb7b810CVE List
  • Linuxaffected: 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 before 2b63341e2ebc9b6f73cbd9214dbe7d46dd98c718CVE List
  • Linuxaffected: 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 before bb63ab52a18273ec68340ac49aebbaa7b514ccd5CVE List
  • Linuxaffected: 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 before 248433942155b42a0ef04a5806c8aca024ea7c33CVE List
  • Linuxaffected: 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 before e70f639aee2ff0def155c256cace9e0f81d998e2CVE List
  • Linuxaffected: 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 before d1ebd9081879fd9ae9c8fb7e8928f19cc88ae320CVE List
  • Linuxaffected: 5.10CVE List
  • Linuxunaffected: all versions before 5.10CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8