CVE-2026-98364 PUBLISHED

xfrm: hold net_device reference under RCU in bundle creation

Assigner: Linux
Reserved: 25.09.2026 Published: 06.10.2026 Updated: 06.10.2026

In the Linux kernel, the following vulnerability has been resolved:

xfrm: hold net_device reference under RCU in bundle creation

xfrm_bundle_create() and xfrm_create_dummy_bundle() read dst->dev into a local pointer without taking a device reference, then pass it to xfrm_fill_dst(). A concurrent RTM_DELLINK replaces dst->dev via dst_dev_put() and frees the old net_device, causing a use-after-free when xfrm6_fill_dst() later dereferences the stale dev pointer.

BUG: KASAN: slab-use-after-free in xfrm6_fill_dst+0x82c/0x860 (net/ipv6/xfrm6_policy.c:86 netdev_hold()) Read of size 8 at addr ffff8880142fe588 by task exploit/153 Call Trace: xfrm6_fill_dst+0x82c/0x860 xfrm_resolve_and_create_bundle+0x21d4/0x2bd0 xfrm_lookup_with_ifid+0x485/0x1640 ip6_dst_lookup_flow+0x19b/0x1e0 udpv6_sendmsg+0x1443/0x2dd0

Fix this by reading dst->dev via dst_dev_rcu() and keeping the RCU read-side critical section active until xfrm_fill_dst() has taken the required device references.

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from 25ee3286dcbc830a833354bb1d15567956844813 to 8d85d6bc9c46dc41cb2be0eac53f8ab068c3a807 (excl.)
  • affected from 25ee3286dcbc830a833354bb1d15567956844813 to 9fa903b24b1f46b4ff5443bcd4aca23e5c57f9c1 (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 2.6.25 is affected
  • unaffected from 0 to 2.6.25 (excl.)
  • unaffected from 7.2.8 to 7.2.* (incl.)
  • unaffected from 7.3-rc4 to * (incl.)

References