CVE-2026-80848

xfrm: espintcp: fix UAF during close

State: Published
Severity: Not scored
Published: Sep 4, 2026
Updated: Oct 19, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: espintcp: fix UAF during close

ZDI reported and analyzed a race condition during close for espintcp sockets:

espintcp_close() frees emsg->skb via kfree_skb() without holding any socket lock. Concurrently, the xfrm_trans_reinject work queue invokes esp_output_tcp_finish() -> espintcp_push_skb() -> espintcp_push_msgs() -> skb_send_sock_locked(), which reads the same skb as a data source.

Fix this by adding a synchronize_rcu() call after resetting sk_prot, since esp_output_tcp_finish() runs under RCU and won't use a socket with sk_prot == &tcp_prot. Simply taking the socket lock in espintcp_close() could lead to leaks, if esp_output_tcp_finish() re-adds an skb in the slot we just freed. After this, the existing barrier() is no longer needed.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before 29121c5e6591da527e8e36ddac7120dc527f574dAffected e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before ed5d9102190c45fc70121c036b0626b740040b75Affected e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before 4bc0dfa28dca6fc0084203732695968049c44072Affected e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before ff8dd7a932f34409a56e1b91a1219340f17457e9Affected e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before 4b31a875693c480c611519faca46216514e3e052Affected e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before 24efebecf415ba264adba0f0491cec436463a14fAffected e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before eb3bbf29c723fe75c0eb92be14f0ec92971fe272Affected e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before 54b41ad14da9a981131ab6e4d3f79321a503ea5dAffected e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before deb232e884877bf10b4ce2580909eedec986c284Affected
LinuxLinux	5.6Affected before 5.6Not affected 5.10.269 through 5.10.Not affected 5.15.220 through 5.15.Not affected 6.1.187 through 6.1.Not affected 6.6.156 through 6.6.Not affected 6.12.108 through 6.12.Not affected 6.18.49 through 6.18.Not affected 7.1.13 through 7.1.Not affected 7.2.3 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before 29121c5e6591da527e8e36ddac7120dc527f574dAffected
e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before ed5d9102190c45fc70121c036b0626b740040b75Affected
e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before 4bc0dfa28dca6fc0084203732695968049c44072Affected
e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before ff8dd7a932f34409a56e1b91a1219340f17457e9Affected
e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before 4b31a875693c480c611519faca46216514e3e052Affected
e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before 24efebecf415ba264adba0f0491cec436463a14fAffected
e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before eb3bbf29c723fe75c0eb92be14f0ec92971fe272Affected
e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before 54b41ad14da9a981131ab6e4d3f79321a503ea5dAffected
e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 to before deb232e884877bf10b4ce2580909eedec986c284Affected

LinuxLinux

5.6Affected
before 5.6Not affected
5.10.269 through 5.10.*Not affected
5.15.220 through 5.15.*Not affected
6.1.187 through 6.1.*Not affected
6.6.156 through 6.6.*Not affected
6.12.108 through 6.12.*Not affected
6.18.49 through 6.18.*Not affected
7.1.13 through 7.1.*Not affected
7.2.3 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.