CVE-2026-98230

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: use hlist_del_init_rcu for state_cache and state_cache_input

Commit 14acf9652e56 ("xfrm: defensively unhash xfrm_state lists in

__xfrm_state_delete") converted bydst/bysrc/byseq/byspi from

hlist_del_rcu() to hlist_del_init_rcu() so that a second

__xfrm_state_delete() on the same object becomes a no-op rather than a

write through LIST_POISON pprev. It missed state_cache and

state_cache_input, which kept hlist_del_rcu():

- hlist_del_rcu() leaves pprev = LIST_POISON2 (non-NULL), so

hlist_unhashed() returns false.

- hlist_del_init_rcu() leaves pprev = NULL, so hlist_unhashed()

returns true.

A second __xfrm_state_delete() therefore enters __hlist_del() on the

already-deleted state_cache/state_cache_input nodes and does

WRITE_ONCE(*pprev, next) through LIST_POISON2 — a write use-after-free

once the slab is reused. The corruption can in turn cause a subsequent

hlist_for_each_entry_rcu traversal to follow a dangl

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References