CVE-2026-98230

What it actually does

Use-after-free write and subsequent read in Linux kernel xfrm state hash lists (state_cache and state_cache_input) caused by hlist_del_rcu leaving poisoned pointers that allow a second __xfrm_state_delete to perform an invalid write through LIST_POISON2, leading to memory corruption and dangling pointers during RCU traversals in xfrm_input_state_lookup.

Why it matters to the business

Linux systems handling IPsec or network security policies face elevated risk of kernel memory corruption, crashes, or local privilege escalation; low public exploitability and absence from known campaigns reduce immediate operational urgency but still require prompt patching on affected kernels.

How an attack unfolds

An attacker with local access crafts repeated xfrm state operations that trigger a second deletion on the same state_cache or state_cache_input entry, causing a write through a poisoned pointer; the resulting corruption can be leveraged during subsequent RCU list walks to achieve read or write primitives for privilege escalation.

How to fix it

Upgrade to a Linux kernel containing the fix that replaces hlist_del_rcu with hlist_del_init_rcu for state_cache and state_cache_input; rebuild and reboot with the patched kernel; apply vendor backports if available for supported distributions.

How to confirm the fix worked

Confirm the kernel source includes the commit switching state_cache and state_cache_input to hlist_del_init_rcu; verify hlist_unhashed returns true after deletion on those lists; test double-delete scenarios and xfrm_input_state_lookup paths under RCU to ensure no poisoned pointer writes occur.

Typical attack path

1. Obtain local user access on a Linux system
2. Trigger xfrm state creation and deletion sequences that hit the vulnerable cache lists
3. Force a double-delete condition to perform the invalid write through LIST_POISON2
4. Trigger RCU traversal paths such as xfrm_input_state_lookup to dereference corrupted pointers
5. Escalate privileges or cause denial of service via memory corruption

How to detect it

Review kernel logs for xfrm-related warnings or crashes involving state_cache or state_cache_input; inspect for use-after-free reports in __hlist_del or xfrm_input_state_lookup; correlate with processes performing frequent xfrm state manipulations.

What your security team should do

• Prioritize kernel updates on any systems using IPsec or xfrm for network security
• Monitor upstream kernel changelogs for the exact patch and backport it to distribution kernels
• Limit local user access and xfrm configuration privileges until patched
• Include the updated kernel in standard patch management cycles within the next maintenance window