CVE-2026-98364

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: xfrm: hold net_device reference under RCU in bundle creation xfrm_bundle_create() and xfrm_create_dummy_bundle() read dst->dev into a local pointer without taking a device reference, then pass it to xfrm_fill_dst(). A concurrent RTM_DELLINK replaces dst->dev via dst_dev_put() and frees the old net_device, causing a use-after-free when xfrm6_fill_dst() later dereferences the stale dev pointer. BUG: KASAN: slab-use-after-free in xfrm6_fill_dst+0x82c/0x860 (net/ipv6/xfrm6_policy.c:86 netdev_hold()) Read of size 8 at addr ffff8880142fe588 by task exploit/153 Call Trace: xfrm6_fill_dst+0x82c/0x860 xfrm_resolve_and_create_bundle+0x21d4/0x2bd0 xfrm_lookup_with_ifid+0x485/0x1640 ip6_dst_lookup_flow+0x19b/0x1e0 udpv6_sendmsg+0x1443/0x2dd0 Fix this by reading dst->dev via dst_dev_rcu() and keeping the RCU read-side critical section active until xfrm_fill_dst() has taken the required device references.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98364

EUVD

EUVD-2026-93349

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	25ee3286dcbc830a833354bb1d15567956844813
Linux	Linux	25ee3286dcbc830a833354bb1d15567956844813
Linux	Linux	2.6.25

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's xfrm (transform) subsystem. It occurs when xfrm_bundle_create() and xfrm_create_dummy_bundle() read a network device pointer without holding a reference, then later dereference a stale pointer after the device has been freed by a concurrent operation like RTM_DELLINK. This leads to a slab-use-after-free error in xfrm6_fill_dst().

Detection Guidance

This vulnerability involves a use-after-free in the Linux kernel's xfrm subsystem. Detection requires checking for kernel logs indicating slab-use-after-free errors in xfrm6_fill_dst or related functions. Monitor kernel logs for KASAN reports or crashes involving xfrm6_fill_dst. Use commands like dmesg | grep -i kasan or journalctl -k | grep -i xfrm6_fill_dst to search for relevant errors.

Impact Analysis

This vulnerability could allow an attacker to cause a denial-of-service (system crash) or potentially execute arbitrary code with kernel privileges. It affects systems using the Linux kernel's xfrm networking features, particularly IPv6 configurations.

Compliance Impact

This vulnerability is a use-after-free flaw in the Linux kernel's xfrm subsystem, which could lead to memory corruption or crashes. While it does not directly impact data protection or privacy controls required by GDPR or HIPAA, such kernel vulnerabilities can indirectly affect compliance by compromising system integrity and availability, potentially leading to unauthorized access or data breaches if exploited.

Mitigation Strategies

Apply the latest kernel security patches from your Linux distribution to resolve this issue. If immediate patching is not possible, consider isolating network-facing services or disabling IPv6 XFRM features as a temporary workaround. Monitor vendor advisories for kernel updates addressing this CVE.

Hi! I’m here to help you understand CVE-2026-98364. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70