Use-after-free in Linux kernel - CVE-2026-98231

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to use-after-free in xfrm_dev_state_free() when deferred device state flushing races with state garbage collection. A local user can trigger concurrent device state flushing and state garbage collection to cause a denial of service.

The device garbage collection list does not hold an xfrm_state reference. Both execution paths can invoke the driver callback and release the device reference.

Affected software

How to mitigate CVE-2026-98231

External References

• https://git.kernel.org/stable/c/39e41af3653ee45c985190dd97426f318918d201
• https://git.kernel.org/stable/c/75fc4561772e2f9811abf39ed10443e6f4a4bc6c
• https://git.kernel.org/stable/c/84e378395494963b1e581cf223a7cbeec8c0e2d6
• https://git.kernel.org/stable/c/89fefad9f971bc637fb22373078144f2563c4be9
• https://git.kernel.org/stable/c/937108dc0258d6ac69926b00bc53598c98986ee1

Related Security Bulletins

• Use-after-free in Linux kernel xfrm
• Debian update for linux