SB20261007133 - Use-after-free in Linux kernel xfrm

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-98230)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to use-after-free in the xfrm state_cache and state_cache_input lists in net/xfrm/xfrm_state.c when deleting the same xfrm state more than once. A local user can trigger repeated deletion of the same state to corrupt kernel memory.

The write use-after-free occurs once the slab is reused. Subsequent list traversal can encounter a dangling next pointer, causing a read use-after-free in xfrm_input_state_lookup().

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/2afb8dc1f4390f164db8352f8e685e126e9db566
• https://git.kernel.org/stable/c/4748c27e2e6a1969e02f1df46e62f79d2799b80b
• https://git.kernel.org/stable/c/9b74a47a4cbd0d29faff4f3b199212c73e6b6220
• https://git.kernel.org/stable/c/fb38fb7420d5f7192f9e2b6ac835ede149cd7ac5