Cloudanix VulnDB

CVE-2026-98370

None

CVSS

—

EPSS

0.2%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the Linux kernel's network security code can let a local program read memory that has already been freed, potentially crashing the system or allowing an attacker to take control.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in xfrm netlink handling: redundant alloc_compat on a compat ALLOCSPI request misinterprets the 228-byte structure as 232 bytes, attaches a translated child via frag_list, and allows a multicast skb clone to observe the child after xfrm_user_rcv_msg frees it.

Why it matters to the business

Kernel memory corruption on Linux systems performing IPsec operations with compat syscalls can cause crashes, denial of service, or local privilege escalation; 17 days since disclosure with stable low EPSS and no KEV listing indicates limited but non-zero urgency for kernel updates.

How an attack unfolds

An attacker issues a compat ALLOCSPI netlink request; xfrm_alloc_userspi performs a second alloc_compat that attaches a child skb; a multicast clone shares skb_shared_info so a receiver can still read the child after the request handler frees it, triggering the use-after-free.

How to fix it

Apply the upstream fix that removes the redundant alloc_compat call in xfrm_alloc_userspi so only dump_one_state performs the translation; rebuild and boot the patched kernel; reboot systems or reload xfrm modules after update.

How to confirm the fix worked

Confirm the patch is present by inspecting net/xfrm/xfrm_user.c for removal of the second alloc_compat; verify no child skb is attached to inbound request skbs in compat paths; run regression tests exercising compat ALLOCSPI requests.

Typical attack path

  1. Craft and send a compat xfrm_userspi_info ALLOCSPI netlink message
  2. Force xfrm_state_netlink and xfrm_alloc_userspi to both call alloc_compat
  3. Trigger multicast skb clone sharing frag_list
  4. Race the free in xfrm_user_rcv_msg against the receiver's copy
  5. Read or write the freed child skb for memory corruption

How to detect it

Inspect netlink audit logs and kernel ftrace for xfrm ALLOCSPI requests from compat processes; look for oops or slab-use-after-free warnings referencing xfrm or skb_shared_info; correlate with processes using 32-bit IPsec syscalls.

What your security team should do

  • Prioritize kernel updates on any system exposing xfrm netlink to unprivileged users
  • Monitor EPSS and threat intel for increase in exploit maturity
  • Restrict unprivileged netlink access via LSM or seccomp where feasible
  • Test the fix in staging before production rollout

The record

In the Linux kernel, the following vulnerability has been resolved: xfrm: fix compat ALLOCSPI request use-after-free xfrm_state_netlink() builds the ALLOCSPI response with dump_one_state(), which already calls alloc_compat() with the response skb and header. xfrm_alloc_userspi() then calls alloc_compat() again, but passes the original request skb and its header. For a compat request, the translator therefore interprets the 228-byte compat xfrm_userspi_info as the 232-byte native layout and reads four bytes past the declared payload. It also publishes the translated child through the request's frag_list. A multicast clone of the request shares skb_shared_info and can observe that child. xfrm_user_rcv_msg() frees it after the request handler returns, racing a compat receiver which may still be copying from it and resulting in a use-after-free. Remove the redundant conversion. The response keeps its correct compat translation from dump_one_state(), and no child is attached to the inbound request.

Affected packages

Ecosystem Package Introduced Fixed