CVE-2026-80846

A flaw was found in the Linux kernel's xfrm subsystem, which handles ESP-in-TCP packets. When queued ESP-in-TCP data is processed after its ingress network device has been removed, the system attempts to dereference a null pointer. This can lead to a system crash, resulting in a Denial of Service (DoS).

ESP-in-TCP can process queued TCP records after the original ingress device has been removed during veth or network namespace teardown. In handle_esp, dev_get_by_index_rcu can then return NULL and the XFRM IPv4 or IPv6 receive path may dereference skb dev while building route lookup data, causing a kernel crash. For the CVSS the PR:N is used because a network peer does not need a local user account on the victim when the ESP-in-TCP endpoint is reachable. The attack still has high complexity because it depends on an ESP-in-TCP deployment and a race with device or namespace teardown. The issue is network reachable in configured IPsec ESP-in-TCP environments, but practical exploitation is more likely inside VPN, storage, container, or data center networks than from the public Internet. Impact is denial of service via NULL pointer dereference and kernel crash. No concrete evidence of UAF, information disclosure, arbitrary write, or privilege escalation is visible from the patch context.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.