CVE-2026-98231

A flaw was found in the Linux kernel's IPsec (XFRM) subsystem. A race condition between device state flushing and background memory cleanup allows kernel memory to be accessed after it has already been freed. A local attacker could exploit this flaw during network device state changes to cause a Denial of Service (DoS) by crashing the system or potentially escalate privileges.

A race between xfrm_dev_state_flush and the XFRM state GC worker can let both paths process the same xfrm_state because the deferred device GC list does not hold a state reference. After the GC worker destroys and frees the state, the device flush path can continue reading the freed object, invoke a driver callback again, and release the device reference again. KASAN confirms a slab use after free in xfrm_dev_state_free. The demonstrated impact is a local kernel crash or reference state corruption. A more serious outcome is plausible because execution continues through fields of a freed kernel object and includes a driver callback, so controlled slab reuse could potentially affect confidentiality, integrity, and availability. For the CVSS the PR:L value is used for the paranoid score because a process with delegated CAP_NET_ADMIN, container root, or a network management service account may be able to control the required XFRM and device operations without having unrestricted host root access. AC:H applies because successful triggering depends on a race window between device state flushing and asynchronous state destruction. The issue is not directly network reachable because remote traffic alone is not shown to initiate the required control plane operations. Impact is at least a local denial of service via kernel crash and in the worst defensible case may permit privilege escalation through kernel use after free.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.