Improper locking in Linux kernel - CVE-2026-98369

Vulnerability details

The vulnerability allows a local user to trigger kernel RCU lockdep warnings.

The vulnerability exists due to missing RCU read-side locking and insufficient object lifetime management in xfrm_trans_reinject() and xfrm_trans_queue_net() when reinjecting transport-mode packets through a workqueue. A local user can cause transport-mode packets to undergo deferred reinjection to trigger kernel RCU lockdep warnings.

Under CONFIG_PREEMPT_RCU, workqueue workers run in process context where local_bh_disable() does not establish an RCU read-side critical section. Queued packets may carry non-reference-counted destination entries, and network-device unregistration can replace a destination's device with blackhole_netdev.

Affected software

How to mitigate CVE-2026-98369

External References

• https://git.kernel.org/stable/c/0cda8273265d30cac6423834fd7d4acb75f04fdb
• https://git.kernel.org/stable/c/41e47f1664be86c91326f0afe0504a1162d00907
• https://git.kernel.org/stable/c/6601d91a85761f33351c71e04ec0bbd294ca07ce
• https://git.kernel.org/stable/c/664fc0941df7c1918b2cd4de6ee00469ba77d8e4
• https://git.kernel.org/stable/c/68a317b4aec8ca1868a39d69e40f9e29baa4f40a
• https://git.kernel.org/stable/c/6eb3b071be8e260543c604550c54dac66e6b174b
• https://git.kernel.org/stable/c/d2f5082f9e84653fa1a9e8aebaaff23e688f5e19

Related Security Bulletins

• Improper locking in Linux kernel xfrm
• Debian update for linux