CVE-2026-80848

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: espintcp: fix UAF during close

ZDI reported and analyzed a race condition during close for espintcp

sockets:

espintcp_close() frees emsg->skb via kfree_skb() without holding

any socket lock. Concurrently, the xfrm_trans_reinject work queue

invokes esp_output_tcp_finish() -> espintcp_push_skb() ->

espintcp_push_msgs() -> skb_send_sock_locked(), which reads the

same skb as a data source.

Fix this by adding a synchronize_rcu() call after resetting sk_prot,

since esp_output_tcp_finish() runs under RCU and won't use a socket

with sk_prot == &tcp_prot. Simply taking the socket lock in

espintcp_close() could lead to leaks, if esp_output_tcp_finish()

re-adds an skb in the slot we just freed. After this, the existing

barrier() is no longer needed.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References