CVE-2026-98370

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix compat ALLOCSPI request use-after-free xfrm_state_netlink() builds the ALLOCSPI response with dump_one_state(), which already calls alloc_compat() with the response skb and header. xfrm_alloc_userspi() then calls alloc_compat() again, but passes the original request skb and its header. For a compat request, the translator therefore interprets the 228-byte compat xfrm_userspi_info as the 232-byte native layout and reads four bytes past the declared payload. It also publishes the translated child through the request's frag_list. A multicast clone of the request shares skb_shared_info and can observe that child. xfrm_user_rcv_msg() frees it after the request handler returns, racing a compat receiver which may still be copying from it and resulting in a use-after-free. Remove the redundant conversion. The response keeps its correct compat translation from dump_one_state(), and no child is attached to the inbound request.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98370

EUVD

EUVD-2026-93355

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3
Linux	Linux	5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3
Linux	Linux	5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3
Linux	Linux	5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3
Linux	Linux	5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3
Linux	Linux	5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3
Linux	Linux	5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3
Linux	Linux	5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3
Linux	Linux	5.10

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's xfrm (IPsec) subsystem. It occurs when processing ALLOCSPI requests in compat mode. The issue arises from redundant memory allocation in xfrm_state_netlink() and xfrm_alloc_userspi(), leading to a child skb being attached to the request. A race condition during cleanup causes a use-after-free when a multicast clone of the request shares skb_shared_info.

Detection Guidance

This vulnerability is specific to the Linux kernel's xfrm subsystem and requires kernel-level inspection. Detection involves checking kernel logs for related errors or using tools like 'dmesg' to identify use-after-free events in xfrm_state_netlink or xfrm_alloc_userspi functions. No direct network commands are applicable.

Impact Analysis

This vulnerability could allow an attacker to cause a denial-of-service (DoS) or potentially execute arbitrary code with kernel privileges. It affects systems using IPsec with compat mode enabled, potentially leading to system crashes or unauthorized access.

Compliance Impact

This vulnerability is a use-after-free issue in the Linux kernel's xfrm subsystem, which could lead to memory corruption or crashes. It does not directly affect compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy rather than kernel memory management.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the use-after-free issue in the xfrm subsystem.

Hi! I’m here to help you understand CVE-2026-98370. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70