CVE-2026-98230

A flaw was found in the Linux kernel's IPsec (xfrm) subsystem. A local attacker can trigger repeated state deletion during cleanup, leading to a use-after-free condition where the kernel attempts to access memory that has already been released. This vulnerability may allow an attacker to achieve privilege escalation or cause a Denial of Service (DoS) by crashing the system.

A use-after-free flaw of Moderate impact was found in the Linux kernel's IPsec (xfrm) subsystem. In net/xfrm/xfrm_state.c, the state_cache and state_cache_input list nodes were removed with hlist_del_rcu(), which leaves the pprev pointer poisoned instead of NULL, so a second __xfrm_state_delete() on the same xfrm state does not recognize these nodes as already unhashed and writes through the stale pointer once the freed slab memory has been reused. The resulting list corruption can also make an RCU traversal in xfrm_input_state_lookup() follow a dangling pointer, producing a read use-after-free. A local attacker with the ability to configure and delete IPsec states (which requires CAP_NET_ADMIN) could use this memory corruption to crash the kernel and cause a denial of service; in the worst case, corruption of reused slab memory could also lead to privilege escalation.

Although the CVSS 3.1 base score is 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), Red Hat rates the impact of this flaw as Moderate: exploitation requires local access with privileges over XFRM state management and depends on timing-dependent reuse of the freed slab object, so the impact is primarily a local denial of service through a kernel panic or crash.

The vulnerable state_cache/state_cache_input handling was introduced upstream in Linux kernel 6.12.13 and 6.13. Per the current Red Hat assessment, supported Red Hat products are not affected: Red Hat Enterprise Linux 7 through 10 (kernel and kernel-rt), Red Hat In-Vehicle Operating System (RHiVOS), and OpenShift RHEL CoreOS streams are all marked not affected. The only remaining assessment entry is Red Hat Enterprise Linux 6 Extended Life Cycle Support, which is out of support scope.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.