CVE-2026-98364

Summary

The Linux kernel's IPsec implementation has a use-after-free vulnerability in the XFRM subsystem where network device references are not properly held under RCU during bundle creation, potentially allowing attackers to corrupt memory or execute code when concurrent network interface removal occurs.

Exploitability

Exploitation requires a specific timing window where a network interface is concurrently removed while an IPsec policy lookup is in progress, making it moderately difficult but possible with careful crafting of network traffic patterns.

Blast radius

The vulnerability affects systems running Linux kernels with IPsec enabled and active policies, potentially leading to kernel memory corruption that could result in system instability or privilege escalation.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Apply the kernel patch that resolves the xfrm use-after-free issue in the net/ipv6/xfrm6_policy.c file by upgrading to a kernel version that includes this fix, specifically targeting kernels with the fix for CVE-2026-98364.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.