CVE-2026-53240
Received Received - Intake
Use-After-Free in Linux Kernel XFRM iptfs

Publication date: 2026-06-25

Last updated on: 2026-06-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: xfrm: iptfs: fix use-after-free on first_skb in __input_process_payload __input_process_payload() stores first_skb into xtfs->ra_newskb under drop_lock when starting partial reassembly, then unlocks and breaks out of the processing loop. The post-loop check reads xtfs->ra_newskb without the lock to decide whether first_skb is still owned: if (first_skb && first_iplen && !defer && first_skb != xtfs->ra_newskb) Between spin_unlock and this read, a concurrent CPU running iptfs_reassem_cont() (or the drop_timer hrtimer) can complete reassembly, NULL xtfs->ra_newskb, and free the skb. The check then evaluates first_skb != NULL as true, and pskb_trim/ip_summed/consume_skb operate on the freed skb — a use-after-free in skbuff_head_cache. Replace the unlocked read with a local bool that records whether first_skb was handed to the reassembly state in the current call. The flag is set after the existing spin_unlock, before the break, using the pointer equality that is stable at that point (first_skb == skb iff first_skb was stored in ra_newskb).
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-25
Last Modified
2026-06-25
Generated
2026-06-25
AI Q&A
2026-06-25
EPSS Evaluated
N/A
NVD
CVE-2026-53240
EUVD
EUVD-2026-39191
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a use-after-free issue in the Linux kernel's xfrm iptfs module, specifically in the __input_process_payload() function. The function stores a pointer called first_skb into a reassembly state variable under a lock, then releases the lock and exits a processing loop. After unlocking, the code reads the pointer without the lock to check if first_skb is still owned. However, between unlocking and this read, another CPU thread can complete the reassembly, nullify the pointer, and free the associated memory. This leads to operations being performed on freed memory, causing a use-after-free condition.

The fix involves replacing the unlocked read with a local boolean flag that records whether first_skb was handed to the reassembly state during the current call, ensuring safe pointer comparison after unlocking.

Impact Analysis

This use-after-free vulnerability can lead to undefined behavior in the Linux kernel, such as memory corruption, system crashes, or potential escalation of privileges. Exploiting this flaw could allow an attacker to execute arbitrary code or cause denial of service by crashing the system.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-53240. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart