CVE-2026-98561: Linux Kernel IPsec Race Condition Vulnerability

CVE-2026-98561 Overview

CVE-2026-98561 is a use-after-free vulnerability in the Linux kernel's Netronome Flow Processor (nfp) network driver. The flaw resides in nfp_net_ipsec_rx(), which drops the XArray lock before taking a reference to the xfrm_state entry it located. A concurrent delete path can erase the entry and drop the final state reference within that window. The receive path then attempts to increment a zero refcount on a state already queued for destruction.

Critical Impact
A race between IPsec RX processing and XFRM state deletion can lead to use-after-free on xfrm_state objects, risking kernel memory corruption and system instability on hosts using Netronome NFP IPsec offload.

Affected Products

Linux kernel versions containing the nfp IPsec RX offload code prior to the fix commits
Systems using Netronome NFP network adapters with IPsec offload enabled
Distributions shipping affected stable kernel branches

Discovery Timeline

2026-10-18 - CVE-2026-98561 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98561

Vulnerability Analysis

The nfp_net_ipsec_rx() function performs an XArray lookup to locate an xfrm_state entry associated with an inbound IPsec packet. The original code released the XArray lock after the lookup but before acquiring a reference on the returned state. During that window, the delete path can call xa_erase() and drop the last reference, queuing the state for destruction.

When the RX path resumes and attempts to increment the refcount, it operates on a zero-reference object. Incrementing a refcount from zero is invalid and signals a use-after-free condition. The driver compounds the issue by queuing firmware invalidation asynchronously, so the delete path does not wait for pending RX processing to drain.

The XFRM garbage collector defers freeing through an RCU grace period, which delays reclamation but does not legitimize taking a reference from zero.

Root Cause

The root cause is improper lock scoping around reference acquisition. The reference on xfrm_state must be taken while holding the XArray lock to prevent concurrent erasure. Releasing the lock before xfrm_state_hold() creates a time-of-check to time-of-use (TOCTOU) race between lookup and reference acquisition.

Attack Vector

Triggering the race requires concurrent IPsec RX traffic and XFRM state teardown on a system using nfp IPsec offload. The condition is timing-sensitive and tied to legitimate kernel paths rather than attacker-controlled input validation. Exploitation requires local privilege to manipulate XFRM state or crafted conditions that induce rapid state deletion while RX is in flight.

No verified public exploit code is available. Technical details are documented in the upstream fix commits. See Kernel Commit 1a983a4 and the related stable backports Kernel Commit 8468d05, Kernel Commit c1b1639, Kernel Commit dd76502, and Kernel Commit fe6c8ea.

Detection Methods for CVE-2026-98561

Indicators of Compromise

Kernel oops or panic messages referencing nfp_net_ipsec_rx, xfrm_state_hold, or refcount_t: increment on 0
Unexpected network driver crashes on hosts using Netronome NFP adapters with IPsec offload enabled
KASAN reports flagging use-after-free in XFRM state objects on affected kernels

Detection Strategies

Inventory kernel builds and identify hosts running affected nfp driver versions without the backported fix commits
Enable KASAN or CONFIG_REFCOUNT_FULL in test environments to surface the race condition during stress testing
Correlate kernel crash telemetry with workloads using IPsec offload on NFP hardware

Monitoring Recommendations

Forward dmesg and /var/log/kern.log to a centralized log store and alert on refcount warnings and nfp driver stack traces
Monitor XFRM state churn rates on IPsec gateways, as high deletion frequency increases race likelihood
Track kernel version compliance across fleet to confirm patch adoption

How to Mitigate CVE-2026-98561

Immediate Actions Required

Apply the upstream fix that acquires the xfrm_state reference before releasing the XArray lock
Update to a stable kernel release containing one of the backport commits referenced in the NVD advisory
On systems where patching is deferred, disable IPsec offload on NFP adapters to avoid the vulnerable code path

Patch Information

The fix moves xfrm_state_hold() inside the XArray lock scope in nfp_net_ipsec_rx() so that xa_erase() cannot run between lookup and reference acquisition. Backports are available in multiple stable branches. See Kernel Commit 1a983a4, Kernel Commit 8468d05, Kernel Commit c1b1639, Kernel Commit dd76502, and Kernel Commit fe6c8ea.

Workarounds

Disable IPsec hardware offload on affected NFP interfaces using ethtool -K <iface> esp-hw-offload off
Avoid rapid teardown of XFRM states on affected hosts until the kernel is patched
Restrict administrative access to XFRM configuration to reduce the attack surface for triggering the race

bash

# Disable IPsec offload on an NFP interface as a temporary mitigation
sudo ethtool -K <nfp_interface> esp-hw-offload off

# Verify current offload settings
sudo ethtool -k <nfp_interface> | grep esp