CVE-2026-98230

Status: UPDATED  |  Advisory ID: CVE-2026-98230

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

xfrm: use hlist_del_init_rcu for state_cache and state_cache_input

Commit 14acf9652e56 ("xfrm: defensively unhash xfrm_state lists in

__xfrm_state_delete") converted bydst/bysrc/byseq/byspi from

hlist_del_rcu() to hlist_del_init_rcu() so that a second

__xfrm_state_delete() on the same object becomes a no-op rather than a

write through LIST_POISON pprev. It missed state_cache and

state_cache_input, which kept hlist_del_rcu():

- hlist_del_rcu() leaves pprev = LIST_POISON2 (non-NULL), so

hlist_unhashed() returns false.

- hlist_del_init_rcu() leaves pprev = NULL, so hlist_unhashed()

returns true.

A second __xfrm_state_delete() therefore enters __hlist_del() on the

already-deleted state_cache/state_cache_input nodes and does

WRITE_ONCE(*pprev, next) through LIST_POISON2 — a write use-after-free

once the slab is reused. The corruption can in turn cause a subsequent

hlist_for_each_entry_rcu traversal to follow a dangling next pointer,

producing the read use-after-free reported in xfrm_input_state_lookup().

Switch state_cache and state_cache_input to hlist_del_init_rcu() to

match the other four lists, closing the write use-after-free and, with

it, the read use-after-free it spawns. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References