CVE-2026-98364

What it actually does

Use-after-free in xfrm_bundle_create and xfrm_create_dummy_bundle when dst->dev is read without a reference and later dereferenced in xfrm_fill_dst after a concurrent RTM_DELLINK frees the net_device via dst_dev_put.

Why it matters to the business

Local attackers can trigger kernel crashes or memory corruption on affected Linux systems, leading to denial of service or potential privilege escalation with no external network access required.

How an attack unfolds

An attacker with local access crafts network operations that invoke xfrm_lookup_with_ifid and udpv6_sendmsg while triggering device deletion, causing the stale dev pointer to be used after free in xfrm6_fill_dst.

How to fix it

Update the Linux kernel to a version containing the fix that uses dst_dev_rcu() and maintains the RCU read-side critical section until device references are acquired in xfrm_fill_dst.

How to confirm the fix worked

Confirm the kernel version includes the RCU-protected dst_dev_rcu() change; reproduce the KASAN report path with concurrent device deletion and xfrm6_fill_dst calls to verify absence of use-after-free.

Typical attack path

1. Obtain local user or process execution on the target system
2. Trigger concurrent RTM_DELLINK to free a net_device while xfrm bundle creation holds a stale pointer
3. Invoke IPv6 UDP send paths that call xfrm_resolve_and_create_bundle and xfrm6_fill_dst
4. Dereference the freed device structure to trigger KASAN-detected use-after-free or memory corruption

How to detect it

Search kernel logs for KASAN slab-use-after-free reports citing xfrm6_fill_dst, xfrm_resolve_and_create_bundle, or netdev_hold during IPv6 UDP operations; inspect audit logs for concurrent RTM_DELLINK events.

• KASAN: slab-use-after-free in xfrm6_fill_dst
• xfrm6_fill_dst+0x82c/0x860
• Read of size 8 at addr .* by task exploit

What your security team should do

• Prioritize kernel updates on all systems exposing IPv6 and xfrm policy handling
• Restrict local user privileges where possible until patched
• Monitor for kernel oops or KASAN reports involving xfrm6_fill_dst and netdev_hold