Cloudanix VulnDB

CVE-2026-98231

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the Linux kernel's network security handling can let local attackers crash the system or potentially gain elevated privileges by triggering a timing issue during cleanup of network states.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in xfrm_dev_state_free caused by concurrent execution of device GC list processing and state GC worker without proper serialization, allowing double-free of device references and access to freed xfrm_state objects.

Why it matters to the business

Linux systems handling IPsec or XFRM network states may experience kernel crashes, memory corruption, or potential local privilege escalation, disrupting network services and requiring urgent patching on affected kernels.

How an attack unfolds

An attacker with local access triggers device flag changes (such as via ioctl) to invoke xfrm_dev_state_flush while concurrently forcing state GC through xfrm_state_gc_destroy, racing on the same state object to cause the use-after-free.

How to fix it

Apply the upstream kernel patch that introduces a mutex to serialize xfrm_state destruction against the deferred-device pass in xfrm_dev_state_flush; rebuild and deploy updated kernels across all affected systems.

How to confirm the fix worked

Verify the presence of the serialization mutex around xfrm_state destruction and device flush paths in the running kernel source or binary; confirm absence of the reported race by reviewing xfrm_dev_state_flush and xfrm_state_gc_task logic.

Typical attack path

  1. Obtain local code execution on a Linux host with XFRM/IPsec configured
  2. Create or manipulate XFRM states via netlink or user APIs
  3. Trigger device notifier events (netif_change_flags) concurrently with state destruction
  4. Force the race between xfrm_state_dev_gc_lock release and xfrm_state_gc_task
  5. Trigger KASAN-detected slab-use-after-free or kernel panic

How to detect it

Search kernel logs and KASAN reports for xfrm_dev_state_free, xfrm_dev_state_flush, and slab-use-after-free messages; inspect for concurrent netlink XFRM operations and device flag change events preceding crashes.

  • BUG: KASAN: slab-use-after-free in xfrm_dev_state_free
  • xfrm_dev_state_free+0x24c/0x2a0
  • xfrm_state_gc_task
  • xfrm_dev_state_flush

What your security team should do

  • Prioritize kernel updates on all systems using XFRM or IPsec
  • Monitor for KASAN or slab-use-after-free reports mentioning xfrm_dev_state_free
  • Restrict unprivileged local access until patches are applied
  • Test network stack stability after upgrade

The record

In the Linux kernel, the following vulnerability has been resolved: xfrm: serialize state GC with device state flush The deferred-device pass in xfrm_dev_state_flush() finds states under xfrm_state_dev_gc_lock, but drops the lock before calling xfrm_dev_state_free() because the driver callback may sleep. The device GC list does not hold an xfrm_state reference, so the state GC worker can destroy the same state concurrently. The race can proceed as follows: CPU 0 CPU 1 find x on the device GC list drop xfrm_state_dev_gc_lock read x->xso.dev xfrm_state_gc_destroy(x) xfrm_dev_state_free(x) xfrm_state_free(x) continue xfrm_dev_state_free(x) Both paths can invoke the driver callback and drop the device reference. CPU 0 can also access the xfrm_state after CPU 1 has freed it. KASAN reported: BUG: KASAN: slab-use-after-free in xfrm_dev_state_free+0x24c/0x2a0 Read of size 8 at addr ffff88810bbaa960 by task poc/102 Call Trace: xfrm_dev_state_free+0x24c/0x2a0 xfrm_dev_state_flush+0x353/0x400 xfrm_dev_event+0x26d/0x3a0 notifier_call_chain+0xc0/0x280 __dev_notify_flags+0x169/0x250 netif_change_flags+0xe7/0x160 dev_change_flags+0x96/0x220 devinet_ioctl+0x7f4/0x1880 Allocated by task 87: xfrm_state_alloc+0x1e/0x5c0 xfrm_add_sa+0xe7f/0x5820 xfrm_user_rcv_msg+0x4f3/0x940 Freed by task 57: kmem_cache_free+0xcb/0x3d0 xfrm_state_gc_task+0x4a8/0x650 process_one_work+0x63a/0x1070 Serialize xfrm_state destruction against the deferred-device pass with a mutex. Keep xfrm_state_dev_gc_lock limited to list operations and retain the existing callback and device-reference release ordering.

Affected packages

Ecosystem Package Introduced Fixed