SB20261023101 - Use-after-free in Linux kernel strparser

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261023101

SB20261023101 - Use-after-free in Linux kernel strparser

Published: October 23, 2026

Security Bulletin ID SB20261023101
CSH Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Local access
Highest impact Denial of service

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Use-after-free (CVE-ID: CVE-2026-99056)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to cause a denial of service through a kernel crash.

The vulnerability exists due to a race-induced use-after-free in the Linux kernel stream parser when strp_done() tears down parser resources before an in-flight strp_recv() call has completed. A local user can trigger overlapping receive processing and parser teardown to access freed memory and potentially crash the kernel.

Only the espintcp user of the stream parser is affected by this race condition.


Remediation

Install update from vendor's website.

References