CVE-2026-80848xfrm: espintcp: fix UAF during close
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: xfrm: espintcp: fix UAF during close ZDI reported and analyzed a race condition during close for espintcp sockets: espintcp_close() frees emsg->skb via kfree_skb() without holding any socket lock. Concurrently, the xfrm_trans_reinject work queue invokes esp_output_tcp_finish() -> espintcp_push_skb() -> espintcp_push_msgs() -> skb_send_sock_locked(), which reads the same skb as a data source. Fix this by adding a synchronize_rcu() call after resetting sk_prot, since esp_output_tcp_finish() runs under RCU and won't use a socket with sk_prot == &tcp_prot. Simply taking the socket lock in espintcp_close() could lead to leaks, if esp_output_tcp_finish() re-adds an skb in the slot we just freed. After this, the existing barrier() is no longer needed.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Sep 4, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 before 29121c5e6591da527e8e36ddac7120dc527f574d; from e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 before ed5d9102190c45fc70121c036b0626b740040b75; from e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 before 4bc0dfa28dca6fc0084203732695968049c44072; from e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 before ff8dd7a932f34409a56e1b91a1219340f17457e9; from e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 before 4b31a875693c480c611519faca46216514e3e052; from e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 before 24efebecf415ba264adba0f0491cec436463a14f; from e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 before eb3bbf29c723fe75c0eb92be14f0ec92971fe272; from e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 before 54b41ad14da9a981131ab6e4d3f79321a503ea5d; and 1 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/29121c5e6591da527e8e36ddac7120dc527f574d
- https://git.kernel.org/stable/c/ed5d9102190c45fc70121c036b0626b740040b75
- https://git.kernel.org/stable/c/4bc0dfa28dca6fc0084203732695968049c44072
- https://git.kernel.org/stable/c/ff8dd7a932f34409a56e1b91a1219340f17457e9
- https://git.kernel.org/stable/c/4b31a875693c480c611519faca46216514e3e052
- https://git.kernel.org/stable/c/24efebecf415ba264adba0f0491cec436463a14f
- https://git.kernel.org/stable/c/eb3bbf29c723fe75c0eb92be14f0ec92971fe272
- https://git.kernel.org/stable/c/54b41ad14da9a981131ab6e4d3f79321a503ea5d
- https://git.kernel.org/stable/c/deb232e884877bf10b4ce2580909eedec986c284
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.