CVE-2026-80848

A flaw was found in the xfrm: espintcp component of the Linux kernel. A race condition exists during the closure of espintcp sockets, where a memory buffer (skb) can be freed while still being accessed by another process. This Use-After-Free (UAF) vulnerability could allow a local attacker to cause memory corruption, potentially leading to a denial of service or other unpredictable system behavior.

A race condition leading to a use-after-free was found in the Linux kernel's xfrm/espintcp (TCP encapsulation of IPsec ESP) implementation. Red Hat Product Security has rated this flaw as IMPORTANT (CVSS 3.1: 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The kernel and kernel-rt packages in Red Hat Enterprise Linux 8, 9, and 10 are affected, as are Red Hat OpenShift and Red Hat In-Vehicle OS streams that ship a vulnerable kernel; a fix is being pursued for the affected streams. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those streams.

During the close of an espintcp socket, espintcp_close() frees emsg->skb via kfree_skb() without holding any socket lock, while the xfrm_trans_reinject work queue can concurrently read the same skb through esp_output_tcp_finish() -> espintcp_push_skb() -> espintcp_push_msgs() -> skb_send_sock_locked(). A local attacker able to trigger this race could cause kernel memory corruption, potentially leading to a denial of service or other unpredictable system behavior. Exploitation requires local access, success in a narrow timing window, and a system using TCP-encapsulated IPsec (espintcp) sockets.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.