CVE-2026-98369 - Vulnerability Details

- xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()

Description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()

syzbot reported a suspicious RCU usage warning in ip6_pkt_drop():

WARNING: suspicious RCU usage in ip6_pkt_drop
include/net/addrconf.h:389 suspicious rcu_dereference_check() usage!

Call Trace:
__in6_dev_get_safely include/net/addrconf.h:389 [inline]
ip6_pkt_drop+0x596/0x610 net/ipv6/route.c:4620
ip6_pkt_discard+0x1c/0x30 net/ipv6/route.c:4651
xfrm_trans_reinject+0x324/0x630 net/xfrm/xfrm_input.c:806
process_one_work kernel/workqueue.c:3322 [inline]
process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486

When commit 4f4920669d21 ("xfrm: Reinject transport-mode packets through
workqueue") converted xfrm_trans_reinject from a tasklet to a workqueue,
the reinjection loop ceased running in softirq context. Workqueue workers
run in process context where local_bh_disable() does not enter an RCU
read-side critical section under CONFIG_PREEMPT_RCU.

Because finish callbacks (such as ip6_rcv_finish) expect to run under an
RCU read lock (performing route lookups, l3mdev lookups, and accessing
RCU-protected data structures), invoking them in workqueue context without
rcu_read_lock() triggers RCU lockdep warnings.

Furthermore, packets queued to the workqueue via xfrm_trans_queue_net()
may carry non-refcounted (noref) dst entries (e.g. from ip_route_input_noref).
Additionally, on netdevice unregistration, dst_dev_put() replaces dst->dev
with blackhole_netdev, so dst entries do not keep skb->dev alive while
queued in the workqueue.

Fix these issues by:
1. Calling skb_dst_force(skb) in xfrm_trans_queue_net() while still in the
caller's RCU section to ensure dst is reference-counted before queuing.
2. Holding a reference on skb->dev via dev_hold()/dev_put() across workqueue
deferral so skb->dev remains valid during finish() callback processing.
3. Acquiring rcu_read_lock() around the finish callback invocation loop in
xfrm_trans_reinject().

Published: 2026-10-06

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability stems from missing synchronization primitives when reinjecting XFRM transport‑mode packets into a workqueue. Without an RCU read lock, a reference to the packet’s destination, and a hold on the network device, the finish callback can operate on data that has already been freed or unreferenced. This mismanagement can lead to a use‑after‑free condition that may cause a kernel crash or arbitrary memory corruption.

Affected Systems

All Linux kernels that have not incorporated the commit adding rcu_read_lock(), skb_dst_force(), and dev_hold() in the XFRM reinjection both upstream kernel releases and distribution packages that have not applied the patch. The CPE indicates the general Linux kernel, and specific vendor versions are not enumerated here.

Risk and Exploitability

Quantitatively, the CVSS score of 7.8 indicates high severity. The EPSS score of less than 1% signals a very low probability of exploitation in the wild, and the flaw is not listed in CISA’s KEV catalog. Based on the description, it is inferred that an attacker might trigger the vulnerability by sending specially crafted IPv6 packets that invoke the XFRM reinjection path inside a workqueue. Such an exploit would require the kernel to process the unsafe finish callback, potentially leading to a crash or, at best, memory corruption.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`7d98b26684cb2390729525b341ea099f0badbe18`	affected	< 41e47f1664be86c91326f0afe0504a1162d00907
`4f4920669d21e1060b7243e5118dc3b71ced1276`	affected	< 6601d91a85761f33351c71e04ec0bbd294ca07ce
`4f4920669d21e1060b7243e5118dc3b71ced1276`	affected	< 0cda8273265d30cac6423834fd7d4acb75f04fdb
`4f4920669d21e1060b7243e5118dc3b71ced1276`	affected	< 68a317b4aec8ca1868a39d69e40f9e29baa4f40a
`4f4920669d21e1060b7243e5118dc3b71ced1276`	affected	< 6eb3b071be8e260543c604550c54dac66e6b174b
`4f4920669d21e1060b7243e5118dc3b71ced1276`	affected	< 664fc0941df7c1918b2cd4de6ee00469ba77d8e4
`4f4920669d21e1060b7243e5118dc3b71ced1276`	affected	< d2f5082f9e84653fa1a9e8aebaaff23e688f5e19
`f520075da484306bbb8425afd2c42404ba74816f`	affected	—
`130d9e5017ade1b81d16783563edb38c12a2eab7`	affected	—
`5.15.75`	affected	< 5.15.222
`5.19.17`	affected	< 5.20
`6.0.3`	affected	< 6.1

Linux

affected

Version	Status	Constraints
`6.1`	affected	—
`0`	unaffected	< 6.1
`5.15.222`	unaffected	≤ 5.15.*
`6.1.189`	unaffected	≤ 6.1.*
`6.6.158`	unaffected	≤ 6.6.*
`6.12.112`	unaffected	≤ 6.12.*
`6.18.54`	unaffected	≤ 6.18.*
`7.2.8`	unaffected	≤ 7.2.*
`7.3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[7d98b26684cb2390729525b341ea099f0badbe18,41e47f1664be86c91326f0afe0504a1162d00907)`	affected	code_commit	—
`[4f4920669d21e1060b7243e5118dc3b71ced1276,6601d91a85761f33351c71e04ec0bbd294ca07ce)`	affected	code_commit	—
`[4f4920669d21e1060b7243e5118dc3b71ced1276,0cda8273265d30cac6423834fd7d4acb75f04fdb)`	affected	code_commit	—
`[4f4920669d21e1060b7243e5118dc3b71ced1276,68a317b4aec8ca1868a39d69e40f9e29baa4f40a)`	affected	code_commit	—
`[4f4920669d21e1060b7243e5118dc3b71ced1276,6eb3b071be8e260543c604550c54dac66e6b174b)`	affected	code_commit	—
`[4f4920669d21e1060b7243e5118dc3b71ced1276,664fc0941df7c1918b2cd4de6ee00469ba77d8e4)`	affected	code_commit	—
`[4f4920669d21e1060b7243e5118dc3b71ced1276,d2f5082f9e84653fa1a9e8aebaaff23e688f5e19)`	affected	code_commit	—
`f520075da484306bbb8425afd2c42404ba74816f`	affected	code_commit	—
`130d9e5017ade1b81d16783563edb38c12a2eab7`	affected	code_commit	—
`[5.15.75,5.15.222)`	affected	semver	—
`[5.19.17,5.20)`	affected	generic	—
`[6.0.3,6.1)`	affected	generic	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.1`	affected	generic	—
`[0,6.1)`	unaffected	generic	—
`[5.15.222,5.15.*]`	unaffected	generic	—
`[6.1.189,6.1.*]`	unaffected	generic	—
`[6.6.158,6.6.*]`	unaffected	generic	—
`[6.12.112,6.12.*]`	unaffected	generic	—
`[6.18.54,6.18.*]`	unaffected	generic	—
`[7.2.8,7.2.*]`	unaffected	generic	—
`[7.3-rc4,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the kernel to include the commit adding rcu_read_lock(), skb_dst_force(), and dev_hold() in the XFRM reinjection routine.
Apply any distribution backported security updates that contain the kernel fix using the standard package management channels.
If the system does not require IPsec or XFRM functionality, consider disabling these modules or services to reduce exposure until a patch is applied.

Generated by OpenCVE AI on October 9, 2026 at 03:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4841-1	linux security update
Debian DLA	DLA-4850-1	linux-6.12 security update
Debian DSA	DSA-6568-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00136.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98369.mbox
https://git.kernel.org/stable/c/0cda8273265d30cac6423834fd7d4acb75f04fdb
https://git.kernel.org/stable/c/41e47f1664be86c91326f0afe0504a1162d00907
https://git.kernel.org/stable/c/6601d91a85761f33351c71e04ec0bbd294ca07ce
https://git.kernel.org/stable/c/664fc0941df7c1918b2cd4de6ee00469ba77d8e4
https://git.kernel.org/stable/c/68a317b4aec8ca1868a39d69e40f9e29baa4f40a
https://git.kernel.org/stable/c/6eb3b071be8e260543c604550c54dac66e6b174b
https://git.kernel.org/stable/c/d2f5082f9e84653fa1a9e8aebaaff23e688f5e19
https://nvd.nist.gov/vuln/detail/CVE-2026-98369
https://www.cve.org/CVERecord?id=CVE-2026-98369

History

Fri, 09 Oct 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-820
References		https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98369.mbox https://nvd.nist.gov/vuln/detail/CVE-2026-98369 https://www.cve.org/CVERecord?id=CVE-2026-98369
Metrics	threat_severity `None`	threat_severity `Moderate`

Wed, 07 Oct 2026 11:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-362 CWE-416

Wed, 07 Oct 2026 07:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Tue, 06 Oct 2026 15:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-362 CWE-416

Tue, 06 Oct 2026 09:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject() syzbot reported a suspicious RCU usage warning in ip6_pkt_drop(): WARNING: suspicious RCU usage in ip6_pkt_drop include/net/addrconf.h:389 suspicious rcu_dereference_check() usage! Call Trace: __in6_dev_get_safely include/net/addrconf.h:389 [inline] ip6_pkt_drop+0x596/0x610 net/ipv6/route.c:4620 ip6_pkt_discard+0x1c/0x30 net/ipv6/route.c:4651 xfrm_trans_reinject+0x324/0x630 net/xfrm/xfrm_input.c:806 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486 When commit 4f4920669d21 ("xfrm: Reinject transport-mode packets through workqueue") converted xfrm_trans_reinject from a tasklet to a workqueue, the reinjection loop ceased running in softirq context. Workqueue workers run in process context where local_bh_disable() does not enter an RCU read-side critical section under CONFIG_PREEMPT_RCU. Because finish callbacks (such as ip6_rcv_finish) expect to run under an RCU read lock (performing route lookups, l3mdev lookups, and accessing RCU-protected data structures), invoking them in workqueue context without rcu_read_lock() triggers RCU lockdep warnings. Furthermore, packets queued to the workqueue via xfrm_trans_queue_net() may carry non-refcounted (noref) dst entries (e.g. from ip_route_input_noref). Additionally, on netdevice unregistration, dst_dev_put() replaces dst->dev with blackhole_netdev, so dst entries do not keep skb->dev alive while queued in the workqueue. Fix these issues by: 1. Calling skb_dst_force(skb) in xfrm_trans_queue_net() while still in the caller's RCU section to ensure dst is reference-counted before queuing. 2. Holding a reference on skb->dev via dev_hold()/dev_put() across workqueue deferral so skb->dev remains valid during finish() callback processing. 3. Acquiring rcu_read_lock() around the finish callback invocation loop in xfrm_trans_reinject().
Title		xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0cda8273265d30cac6423834fd7d4acb75f04fdb https://git.kernel.org/stable/c/41e47f1664be86c91326f0afe0504a1162d00907 https://git.kernel.org/stable/c/6601d91a85761f33351c71e04ec0bbd294ca07ce https://git.kernel.org/stable/c/664fc0941df7c1918b2cd4de6ee00469ba77d8e4 https://git.kernel.org/stable/c/68a317b4aec8ca1868a39d69e40f9e29baa4f40a https://git.kernel.org/stable/c/6eb3b071be8e260543c604550c54dac66e6b174b https://git.kernel.org/stable/c/d2f5082f9e84653fa1a9e8aebaaff23e688f5e19

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-10-06T08:46:54.188Z

Updated: 2026-10-19T09:18:21.221Z

Reserved: 2026-09-25T10:25:14.344Z

Link: CVE-2026-98369

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-10-06T09:18:31.280

Modified: 2026-10-19T10:18:40.010

Link: CVE-2026-98369

Redhat

Severity : Moderate

Publid Date: 2026-10-06T00:00:00Z

Links: CVE-2026-98369 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-09T03:30:06Z

Weaknesses

CWE-820
Missing Synchronization

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object