CVE-2026-98369 Overview
CVE-2026-98369 affects the Linux kernel's IPsec transformation (xfrm) subsystem. The vulnerability resides in xfrm_trans_reinject() within net/xfrm/xfrm_input.c, where missing rcu_read_lock(), skb_dst_force(), and dev_hold() calls can lead to use-after-free conditions when processing transport-mode IPsec packets. The flaw was introduced when commit 4f4920669d21 converted packet reinjection from a tasklet to a workqueue, moving execution from softirq to process context where RCU read-side critical sections are no longer implicit under CONFIG_PREEMPT_RCU.
Critical Impact
A local attacker can trigger kernel memory corruption through crafted IPsec traffic, potentially achieving privilege escalation or denial of service on affected Linux systems.
Affected Products
- Linux kernel versions containing commit 4f4920669d21 ("xfrm: Reinject transport-mode packets through workqueue")
- Linux distributions shipping vulnerable kernel builds with IPsec/xfrm enabled
- Systems using transport-mode IPsec (IPv4 and IPv6)
Discovery Timeline
- 2026-10-06 - CVE-2026-98369 published to NVD
- 2026-10-07 - Last updated in NVD database
Technical Details for CVE-2026-98369
Vulnerability Analysis
The vulnerability was discovered by syzbot, which reported a suspicious RCU usage warning in ip6_pkt_drop(). The warning originates at include/net/addrconf.h:389 during __in6_dev_get_safely() invocation from the xfrm reinjection code path.
Finish callbacks such as ip6_rcv_finish assume execution within an RCU read-side critical section. They perform route lookups, l3mdev lookups, and dereference RCU-protected data structures. When the reinjection loop runs in workqueue (process) context without an explicit rcu_read_lock(), these dereferences become unsafe and trigger lockdep warnings that indicate real memory-safety hazards.
Additionally, packets queued via xfrm_trans_queue_net() may carry non-refcounted (noref) destination entries originating from paths like ip_route_input_noref. On netdevice unregistration, dst_dev_put() replaces dst->dev with blackhole_netdev, meaning queued skbs cannot rely on dst entries to keep skb->dev alive. Processing such skbs in the workqueue after device teardown can dereference freed network device structures.
Root Cause
The root cause is a context-change regression. Commit 4f4920669d21 moved packet reinjection from softirq to workqueue context. Under CONFIG_PREEMPT_RCU, local_bh_disable() in process context does not enter an RCU read-side critical section, breaking the implicit RCU protection that the finish callbacks previously relied upon. Simultaneously, no reference-counting was added for the dst entry or the underlying skb->dev, exposing the queued packets to teardown races.
Attack Vector
Exploitation requires local access and the ability to generate IPsec transport-mode traffic that transits the xfrm reinjection path. An attacker who can trigger netdevice unregistration or race against route invalidation can cause the workqueue worker to dereference freed memory, resulting in kernel panic or memory corruption suitable for privilege escalation.
No public proof-of-concept exploit is available. The vulnerability was found via kernel fuzzing (syzbot). Technical details are available in the referenced Linux Kernel Commit 0cda827 and companion fixes.
Detection Methods for CVE-2026-98369
Indicators of Compromise
- Kernel log entries containing WARNING: suspicious RCU usage in ip6_pkt_drop referencing include/net/addrconf.h:389
- Call traces including xfrm_trans_reinject, ip6_pkt_discard, and process_scheduled_works
- Unexpected kernel oops or panic messages originating from net/xfrm/xfrm_input.c or net/ipv6/route.c
- Repeated kernel crashes on hosts running IPsec transport mode following network interface churn
Detection Strategies
- Enable CONFIG_PROVE_RCU and CONFIG_DEBUG_LOCK_ALLOC in test environments to surface RCU lockdep warnings early
- Monitor /var/log/kern.log and dmesg for xfrm-related warnings and backtraces
- Correlate kernel crash dumps with periods of high IPsec traffic or NIC state changes
Monitoring Recommendations
- Centralize kernel log collection and alert on xfrm_trans_reinject or ip6_pkt_drop lockdep warnings
- Track kernel version inventory to identify hosts running kernels between the regression commit 4f4920669d21 and the fix commits listed in references
- Alert on repeated soft lockups or RCU stalls on hosts running IPsec workloads
How to Mitigate CVE-2026-98369
Immediate Actions Required
- Apply the upstream kernel patches referenced in the NVD advisory and rebuild or update affected kernels
- Prioritize patching on systems that terminate IPsec transport-mode tunnels or run multi-tenant workloads with local user access
- Reboot into the patched kernel; the fix cannot be applied via live module reload for the xfrm input path
Patch Information
The fix applies three corrections to net/xfrm/xfrm_input.c: calling skb_dst_force(skb) in xfrm_trans_queue_net() while still in the caller's RCU section to ensure the dst is reference-counted before queuing; holding a reference on skb->dev via dev_hold()/dev_put() across workqueue deferral so the device remains valid during finish-callback processing; and acquiring rcu_read_lock() around the finish callback invocation loop. Patches are available as Linux Kernel Commit 0cda827, Linux Kernel Commit 41e47f1, Linux Kernel Commit 6601d91, Linux Kernel Commit 664fc09, Linux Kernel Commit 68a317b, Linux Kernel Commit 6eb3b07, and Linux Kernel Commit d2f5082.
Workarounds
- Disable transport-mode IPsec where it is not required to eliminate the vulnerable code path
- Restrict local user access on hosts that cannot be patched immediately
- Avoid dynamic netdevice teardown operations on hosts actively carrying IPsec transport-mode traffic until the patch is applied
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.