CVE-2026-80848
Received Received - Intake

Use-After-Free in Linux Kernel XFRM ESPINTCP

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: xfrm: espintcp: fix UAF during close ZDI reported and analyzed a race condition during close for espintcp sockets: espintcp_close() frees emsg->skb via kfree_skb() without holding any socket lock. Concurrently, the xfrm_trans_reinject work queue invokes esp_output_tcp_finish() -> espintcp_push_skb() -> espintcp_push_msgs() -> skb_send_sock_locked(), which reads the same skb as a data source. Fix this by adding a synchronize_rcu() call after resetting sk_prot, since esp_output_tcp_finish() runs under RCU and won't use a socket with sk_prot == &tcp_prot. Simply taking the socket lock in espintcp_close() could lead to leaks, if esp_output_tcp_finish() re-adds an skb in the slot we just freed. After this, the existing barrier() is no longer needed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80848
EUVD
EUVD-2026-71298

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a use-after-free (UAF) issue in the Linux kernel's espintcp socket handling. It occurs during socket closure when espintcp_close() frees a socket buffer (skb) without proper synchronization. Concurrently, the xfrm_trans_reinject work queue may access the same freed skb, leading to potential memory corruption or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's espintcp module and involves a race condition during socket closure. Detection requires checking kernel logs for espintcp-related errors or crashes, particularly during high network traffic or socket operations. Use commands like dmesg | grep espintcp or journalctl -k | grep espintcp to inspect kernel logs for suspicious activity.

Impact Analysis

This vulnerability could cause system instability, crashes, or privilege escalation if exploited. Systems using espintcp sockets (e.g., IPsec with TCP encapsulation) are at risk. Attackers might trigger the race condition to corrupt memory or execute arbitrary code.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version that includes the fix for this vulnerability. Check your distribution's security advisories for kernel updates and apply them promptly. If updating is not immediately possible, consider disabling espintcp functionality if it is not critical to your operations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80848. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart