Use-after-free in Linux kernel - CVE-2026-98230

Vulnerability details

The vulnerability allows a local user to corrupt kernel memory.

The vulnerability exists due to use-after-free in the xfrm state_cache and state_cache_input lists in net/xfrm/xfrm_state.c when deleting the same xfrm state more than once. A local user can trigger repeated deletion of the same state to corrupt kernel memory.

The write use-after-free occurs once the slab is reused. Subsequent list traversal can encounter a dangling next pointer, causing a read use-after-free in xfrm_input_state_lookup().

Affected software

How to mitigate CVE-2026-98230

External References

• https://git.kernel.org/stable/c/2afb8dc1f4390f164db8352f8e685e126e9db566
• https://git.kernel.org/stable/c/4748c27e2e6a1969e02f1df46e62f79d2799b80b
• https://git.kernel.org/stable/c/9b74a47a4cbd0d29faff4f3b199212c73e6b6220
• https://git.kernel.org/stable/c/fb38fb7420d5f7192f9e2b6ac835ede149cd7ac5

Related Security Bulletins

• Use-after-free in Linux kernel xfrm
• Debian update for linux