CVE-2026-98229

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: xfrm: save input state data before secpath resets xfrm_input() stores the current xfrm_state in the skb secpath while it continues receive-side processing. Some input paths can reset that secpath before xfrm_input() has finished dereferencing the state. Receive callback users such as VTI and XFRM interfaces can reset the secpath. The VTI receive path does so before checking whether the packet crosses network namespaces, while the XFRM interface path does so only for cross-network-namespace packets. The XFRM_MAX_DEPTH error path can also reset the secpath before the final drop callback reports the current state's protocol. If secpath_reset() drops the last state reference while the state is concurrently deleted, xfrm_input() can still dereference the freed state when selecting transport_finish() or reporting the drop callback protocol. Save the state protocol on the stack while the state is still valid, and use the already saved address family for transport_finish(). A larval XFRM_STATE_ACQ state has no type, so retain nexthdr as its protocol. This preserves the existing drop-path fallback while avoiding the post-reset state dereferences without adding an extra state reference to every received packet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98229

EUVD

EUVD-2026-93157

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	df3893c176e9b0bb39b28ab5ec8113fa20ad1ee0
Linux	Linux	df3893c176e9b0bb39b28ab5ec8113fa20ad1ee0
Linux	Linux	df3893c176e9b0bb39b28ab5ec8113fa20ad1ee0
Linux	Linux	df3893c176e9b0bb39b28ab5ec8113fa20ad1ee0
Linux	Linux	3.15

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a race condition where the xfrm_input() function stores state data in the skb secpath but some input paths reset this secpath before processing completes. This can lead to use-after-free issues if the state is deleted while still being referenced, potentially causing crashes or other security issues.

Detection Guidance

This vulnerability is specific to the Linux kernel's xfrm_input() function and requires kernel-level inspection. Detection involves checking kernel logs for XFRM-related errors or crashes, particularly involving secpath resets. Commands like dmesg, journalctl -k, or checking /var/log/kern.log may reveal issues. No direct network commands detect this as it is a kernel memory safety issue.

Impact Analysis

If exploited, this vulnerability could allow an attacker to cause a denial-of-service condition by crashing the system or trigger undefined behavior due to accessing freed memory. Systems using VTI or XFRM interfaces are particularly at risk.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a Linux kernel security flaw related to state management in network packet processing. Compliance impacts would depend on system configuration and use case rather than the vulnerability itself.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve this vulnerability. Monitor kernel security advisories and apply patches promptly.

Hi! I’m here to help you understand CVE-2026-98229. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70