FKIE_CVE-2026-98370

Vulnerability from fkie_nvd - Published: 2026-10-06 09:18 - Updated: 2026-10-06 09:18
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: xfrm: fix compat ALLOCSPI request use-after-free xfrm_state_netlink() builds the ALLOCSPI response with dump_one_state(), which already calls alloc_compat() with the response skb and header. xfrm_alloc_userspi() then calls alloc_compat() again, but passes the original request skb and its header. For a compat request, the translator therefore interprets the 228-byte compat xfrm_userspi_info as the 232-byte native layout and reads four bytes past the declared payload. It also publishes the translated child through the request's frag_list. A multicast clone of the request shares skb_shared_info and can observe that child. xfrm_user_rcv_msg() frees it after the request handler returns, racing a compat receiver which may still be copying from it and resulting in a use-after-free. Remove the redundant conversion. The response keeps its correct compat translation from dump_one_state(), and no child is attached to the inbound request.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/17893987e52918c23945c42e47e894a936305a25
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/248433942155b42a0ef04a5806c8aca024ea7c33
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2b63341e2ebc9b6f73cbd9214dbe7d46dd98c718
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/42971ea17c7a8afc0bdd5ca40648bf4e5bb7b810
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/494f2bee9d8d0ebcfa249ac41bed7fed26d119b4
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/bb63ab52a18273ec68340ac49aebbaa7b514ccd5
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/d1ebd9081879fd9ae9c8fb7e8928f19cc88ae320
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/e70f639aee2ff0def155c256cace9e0f81d998e2
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/xfrm/xfrm_user.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "494f2bee9d8d0ebcfa249ac41bed7fed26d119b4",
              "status": "affected",
              "version": "5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3",
              "versionType": "git"
            },
            {
              "lessThan": "17893987e52918c23945c42e47e894a936305a25",
              "status": "affected",
              "version": "5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3",
              "versionType": "git"
            },
            {
              "lessThan": "42971ea17c7a8afc0bdd5ca40648bf4e5bb7b810",
              "status": "affected",
              "version": "5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3",
              "versionType": "git"
            },
            {
              "lessThan": "2b63341e2ebc9b6f73cbd9214dbe7d46dd98c718",
              "status": "affected",
              "version": "5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3",
              "versionType": "git"
            },
            {
              "lessThan": "bb63ab52a18273ec68340ac49aebbaa7b514ccd5",
              "status": "affected",
              "version": "5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3",
              "versionType": "git"
            },
            {
              "lessThan": "248433942155b42a0ef04a5806c8aca024ea7c33",
              "status": "affected",
              "version": "5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3",
              "versionType": "git"
            },
            {
              "lessThan": "e70f639aee2ff0def155c256cace9e0f81d998e2",
              "status": "affected",
              "version": "5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3",
              "versionType": "git"
            },
            {
              "lessThan": "d1ebd9081879fd9ae9c8fb7e8928f19cc88ae320",
              "status": "affected",
              "version": "5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/xfrm/xfrm_user.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.10"
            },
            {
              "lessThan": "5.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: fix compat ALLOCSPI request use-after-free\n\nxfrm_state_netlink() builds the ALLOCSPI response with\ndump_one_state(), which already calls alloc_compat() with the response\nskb and header.\n\nxfrm_alloc_userspi() then calls alloc_compat() again, but passes the\noriginal request skb and its header. For a compat request, the\ntranslator therefore interprets the 228-byte compat xfrm_userspi_info\nas the 232-byte native layout and reads four bytes past the declared\npayload. It also publishes the translated child through the request\u0027s\nfrag_list.\n\nA multicast clone of the request shares skb_shared_info and can observe\nthat child. xfrm_user_rcv_msg() frees it after the request handler\nreturns, racing a compat receiver which may still be copying from it and\nresulting in a use-after-free.\n\nRemove the redundant conversion. The response keeps its correct compat\ntranslation from dump_one_state(), and no child is attached to the\ninbound request."
    }
  ],
  "id": "CVE-2026-98370",
  "lastModified": "2026-10-06T09:18:31.450",
  "metrics": {},
  "published": "2026-10-06T09:18:31.450",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/17893987e52918c23945c42e47e894a936305a25"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/248433942155b42a0ef04a5806c8aca024ea7c33"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/2b63341e2ebc9b6f73cbd9214dbe7d46dd98c718"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/42971ea17c7a8afc0bdd5ca40648bf4e5bb7b810"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/494f2bee9d8d0ebcfa249ac41bed7fed26d119b4"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/bb63ab52a18273ec68340ac49aebbaa7b514ccd5"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/d1ebd9081879fd9ae9c8fb7e8928f19cc88ae320"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/e70f639aee2ff0def155c256cace9e0f81d998e2"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.