Cloudanix VulnDB

CVE-2026-98369

High · 7.8

CVSS

7.8

EPSS

0.1%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A missing safeguard in the Linux kernel's network packet handling can cause crashes or instability during certain encrypted connections, requiring an operating system update to restore stability.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Missing RCU read lock, dst reference forcing, and device hold in the transport-mode reinjection workqueue path allows RCU-protected data access and non-refcounted dst/skb-dev structures outside a valid critical section, enabling use-after-free, invalid memory access, or lockdep warnings during IPv6 packet finish callbacks.

Why it matters to the business

Networking instability or kernel crashes on systems performing IPsec transport-mode operations can cause service outages, degraded connectivity, or unexpected reboots, increasing operational overhead especially in environments with high downstream kernel usage.

How an attack unfolds

An attacker with local access triggers packet reinjection through the xfrm workqueue (via crafted IPsec flows or syzkaller-style fuzzing), relying on the missing protections to race with netdevice unregistration or route cache changes and corrupt or access freed structures during finish callbacks.

How to fix it

Apply the upstream kernel commit that adds skb_dst_force in the queue path, dev_hold/dev_put around deferral, and rcu_read_lock around the reinjection loop; rebuild and deploy updated kernels across affected systems.

How to confirm the fix worked

Boot a patched kernel, run network workloads exercising xfrm transport mode, and confirm absence of RCU warnings in dmesg and no crashes under concurrent device removal or route changes.

Typical attack path

  1. Obtain local code execution or user privileges
  2. Establish or manipulate IPsec transport-mode security associations
  3. Trigger xfrm_trans_queue_net followed by workqueue processing under concurrent netdevice or route changes
  4. Cause finish callbacks to run without RCU protection or valid dst/dev references leading to crash or memory corruption

How to detect it

Inspect kernel logs for RCU warnings referencing ip6_pkt_drop, xfrm_trans_reinject, or addrconf.h during workqueue processing; correlate with IPsec activity and netdevice events.

What your security team should do

  • Prioritize kernel updates on all systems using IPsec transport mode
  • Monitor for related syzkaller reports or backports in distribution kernels
  • Test reinjection paths in staging environments before broad rollout

The record

In the Linux kernel, the following vulnerability has been resolved: xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject() syzbot reported a suspicious RCU usage warning in ip6_pkt_drop(): WARNING: suspicious RCU usage in ip6_pkt_drop include/net/addrconf.h:389 suspicious rcu_dereference_check() usage! Call Trace: __in6_dev_get_safely include/net/addrconf.h:389 [inline] ip6_pkt_drop+0x596/0x610 net/ipv6/route.c:4620 ip6_pkt_discard+0x1c/0x30 net/ipv6/route.c:4651 xfrm_trans_reinject+0x324/0x630 net/xfrm/xfrm_input.c:806 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486 When commit 4f4920669d21 ("xfrm: Reinject transport-mode packets through workqueue") converted xfrm_trans_reinject from a tasklet to a workqueue, the reinjection loop ceased running in softirq context. Workqueue workers run in process context where local_bh_disable() does not enter an RCU read-side critical section under CONFIG_PREEMPT_RCU. Because finish callbacks (such as ip6_rcv_finish) expect to run under an RCU read lock (performing route lookups, l3mdev lookups, and accessing RCU-protected data structures), invoking them in workqueue context without rcu_read_lock() triggers RCU lockdep warnings. Furthermore, packets queued to the workqueue via xfrm_trans_queue_net() may carry non-refcounted (noref) dst entries (e.g. from ip_route_input_noref). Additionally, on netdevice unregistration, dst_dev_put() replaces dst->dev with blackhole_netdev, so dst entries do not keep skb->dev alive while queued in the workqueue. Fix these issues by: 1. Calling skb_dst_force(skb) in xfrm_trans_queue_net() while still in the caller's RCU section to ensure dst is reference-counted before queuing. 2. Holding a reference on skb->dev via dev_hold()/dev_put() across workqueue deferral so skb->dev remains valid during finish() callback processing. 3. Acquiring rcu_read_lock() around the finish callback invocation loop in xfrm_trans_reinject().

Affected packages

Ecosystem Package Introduced Fixed