CVE-2026-98368

A flaw was found in the Linux kernel's IPsec Encapsulating Security Payload (ESP) subsystem. When transmitting network packets using zero-copy operations on out-of-place paths, the kernel modifies packet fragment structures without properly updating reference counts for managed memory pages. A local user can exploit this vulnerability by sending network traffic with zero-copy buffers, causing pages to be prematurely released while still in use. This flaw leads to a use-after-free condition that can result in a Denial of Service (DoS) through a kernel crash or potentially allow privilege escalation.

This vulnerability is rated as Moderate impact because successful exploitation requires local user access and is constrained to systems routing zero-copy socket traffic across IPsec ESP tunnels utilizing out-of-place cryptographic processing. Although the underlying use-after-free flaw could lead to a kernel crash or potential local privilege escalation, it cannot be triggered remotely by network adversaries. Consequently, typical deployments lacking IPsec encapsulation or unprivileged zero-copy networking remain unexposed to remote threats, keeping the risk contained.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.