CVE-2026-98370xfrm: fix compat ALLOCSPI request use-after-free
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: xfrm: fix compat ALLOCSPI request use-after-free xfrm_state_netlink() builds the ALLOCSPI response with dump_one_state(), which already calls alloc_compat() with the response skb and header. xfrm_alloc_userspi() then calls alloc_compat() again, but passes the original request skb and its header. For a compat request, the translator therefore interprets the 228-byte compat xfrm_userspi_info as the 232-byte native layout and reads four bytes past the declared payload. It also publishes the translated child through the request's frag_list. A multicast clone of the request shares skb_shared_info and can observe that child. xfrm_user_rcv_msg() frees it after the request handler returns, racing a compat receiver which may still be copying from it and resulting in a use-after-free. Remove the redundant conversion. The response keeps its correct compat translation from dump_one_state(), and no child is attached to the inbound request.
- CVSS
- Not yet scored
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 19, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 before 494f2bee9d8d0ebcfa249ac41bed7fed26d119b4; from 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 before 17893987e52918c23945c42e47e894a936305a25; from 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 before 42971ea17c7a8afc0bdd5ca40648bf4e5bb7b810; 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 builds before 2b63341e2ebc9b6f73cbd9214dbe7d46dd98c718; from 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 before bb63ab52a18273ec68340ac49aebbaa7b514ccd5; from 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 before 248433942155b42a0ef04a5806c8aca024ea7c33; from 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 before e70f639aee2ff0def155c256cace9e0f81d998e2; from 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3 before d1ebd9081879fd9ae9c8fb7e8928f19cc88ae320 | CNA record |
References
- https://git.kernel.org/stable/c/494f2bee9d8d0ebcfa249ac41bed7fed26d119b4
- https://git.kernel.org/stable/c/17893987e52918c23945c42e47e894a936305a25
- https://git.kernel.org/stable/c/42971ea17c7a8afc0bdd5ca40648bf4e5bb7b810
- https://git.kernel.org/stable/c/2b63341e2ebc9b6f73cbd9214dbe7d46dd98c718
- https://git.kernel.org/stable/c/bb63ab52a18273ec68340ac49aebbaa7b514ccd5
- https://git.kernel.org/stable/c/248433942155b42a0ef04a5806c8aca024ea7c33
- https://git.kernel.org/stable/c/e70f639aee2ff0def155c256cace9e0f81d998e2
- https://git.kernel.org/stable/c/d1ebd9081879fd9ae9c8fb7e8928f19cc88ae320
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.