CVE-2026-98369

A flaw was found in the Linux kernel's IPsec (xfrm) subsystem. This flaw can lead to a Denial of Service (DoS) due to missing synchronization locks and device references when reinjecting transport-mode network packets through workqueues. A remote attacker could exploit this vulnerability by sending network traffic processed by IPsec, causing the kernel to access invalid memory structures and resulting in a system crash.

A Moderate impact flaw was found in the Linux kernel IPsec (xfrm) subsystem, affecting the kernel packages in Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases that ship the RHEL 9 based CoreOS. Upstream commit 4f4920669d21 ("xfrm: Reinject transport-mode packets through workqueue") moved transport-mode packet reinjection from a tasklet to a workqueue; in workqueue (process) context the finish callbacks run without the RCU read lock they expect, and queued packets may carry non-refcounted destination entries and no longer hold a reference to their network device. As a result, network traffic processed by IPsec transport mode can cause the kernel to access invalid memory structures and crash, resulting in a denial of service. Red Hat Enterprise Linux 6 ELS is out of support scope, and Red Hat Enterprise Linux 7 and 8, including kernel-rt and the OpenShift release based on the RHEL 8 CoreOS, are not affected because the vulnerable code is not present in those versions. For the affected products the fix is deferred to a future update, leaving a residual risk that an attacker able to send traffic processed by IPsec to an affected system can crash the kernel. Red Hat rates this flaw as Moderate (CVSS 5.5, availability-only impact), which differs from the upstream CVE record score of 7.8 (Important) that also assumes high confidentiality and integrity impacts not supported by the technical evidence.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.