CVE-2026-98230

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: xfrm: use hlist_del_init_rcu for state_cache and state_cache_input Commit 14acf9652e56 ("xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete") converted bydst/bysrc/byseq/byspi from hlist_del_rcu() to hlist_del_init_rcu() so that a second __xfrm_state_delete() on the same object becomes a no-op rather than a write through LIST_POISON pprev. It missed state_cache and state_cache_input, which kept hlist_del_rcu(): - hlist_del_rcu() leaves pprev = LIST_POISON2 (non-NULL), so hlist_unhashed() returns false. - hlist_del_init_rcu() leaves pprev = NULL, so hlist_unhashed() returns true. A second __xfrm_state_delete() therefore enters __hlist_del() on the already-deleted state_cache/state_cache_input nodes and does WRITE_ONCE(*pprev, next) through LIST_POISON2 — a write use-after-free once the slab is reused. The corruption can in turn cause a subsequent hlist_for_each_entry_rcu traversal to follow a dangling next pointer, producing the read use-after-free reported in xfrm_input_state_lookup(). Switch state_cache and state_cache_input to hlist_del_init_rcu() to match the other four lists, closing the write use-after-free and, with it, the read use-after-free it spawns.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98230

EUVD

EUVD-2026-93158

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	aa48a18fdb0911572d133057cd579db704b87da4
Linux	Linux	0045e3d80613cc7174dc15f189ee6fc4e73b9365
Linux	Linux	0045e3d80613cc7174dc15f189ee6fc4e73b9365
Linux	Linux	0045e3d80613cc7174dc15f189ee6fc4e73b9365
Linux	Linux	5e4334dc39443645415450163ff5ff1ee7e79784
Linux	Linux	6.12.13
Linux	Linux	6.13

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's xfrm (transform) subsystem. It occurs when state_cache and state_cache_input lists use hlist_del_rcu() instead of hlist_del_init_rcu(). This allows a second deletion to write through a poisoned pointer, causing memory corruption and potential arbitrary code execution.

Detection Guidance

This vulnerability is specific to the Linux kernel's xfrm subsystem and involves use-after-free conditions in state_cache and state_cache_input lists. Detection requires checking kernel logs for related errors or kernel crashes. Commands like dmesg, journalctl -k, or checking for kernel oops messages may reveal issues. However, no direct detection commands are provided in the context.

Impact Analysis

An attacker could exploit this to crash the system or execute arbitrary code with kernel privileges. This could lead to denial of service, privilege escalation, or data compromise on affected Linux systems.

Compliance Impact

This vulnerability is a use-after-free issue in the Linux kernel's xfrm state handling, which could lead to memory corruption and potential arbitrary code execution. Such vulnerabilities may impact compliance with GDPR by compromising data integrity and security, and with HIPAA by potentially exposing protected health information through unauthorized access or system instability.

Mitigation Strategies

Apply the kernel patch referenced in the CVE description (commit 14acf9652e56) to switch state_cache and state_cache_input to hlist_del_init_rcu(). Update to a patched Linux kernel version that includes this fix. Monitor kernel logs for any signs of exploitation or crashes after applying the patch.

Hi! I’m here to help you understand CVE-2026-98230. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70