CVE-2026-98241
Received
Received - Intake
Linux Kernel IPv6 XFRM Local Error Path Use-After-Free
Vulnerability report for CVE-2026-98241, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-06
Last updated on: 2026-10-06
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
ipv6: xfrm: use full sockets in local error paths
xfrm6_local_rxpmtu() and xfrm6_local_error() dereference skb->sk as if it
always pointed at a full IPv6 socket.
That is not guaranteed. TCP SYN-ACK skbs can be owned by a
TCP_NEW_SYN_RECV request_sock while the output path itself is driven by the
full listener. If rerouting selects an IPv6 XFRM tunnel route with a lower
MTU, the local PMTU/error handling path can reach these callbacks with that
mini-socket still attached to the skb.
The callbacks then miscast the request socket as a full inet/IPv6 socket and
can read beyond the request_sock allocation when they access inet_sock or
ipv6_pinfo state.
Resolve the owner with skb_to_full_sk() in both callbacks and bail out when
no full socket is attached. This matches the surrounding XFRM IPv6 PMTU/error
logic, which already reasons about full sockets with skb_to_full_sk().
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Linux | Linux | dd767856a36e00b631d65ebc4bb81b19915532d6 |
| Linux | Linux | dd767856a36e00b631d65ebc4bb81b19915532d6 |
| Linux | Linux | dd767856a36e00b631d65ebc4bb81b19915532d6 |
| Linux | Linux | dd767856a36e00b631d65ebc4bb81b19915532d6 |
| Linux | Linux | dd767856a36e00b631d65ebc4bb81b19915532d6 |
| Linux | Linux | dd767856a36e00b631d65ebc4bb81b19915532d6 |
| Linux | Linux | dd767856a36e00b631d65ebc4bb81b19915532d6 |
| Linux | Linux | dd767856a36e00b631d65ebc4bb81b19915532d6 |
| Linux | Linux | 3.2 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
