CVE-2026-98369

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()

syzbot reported a suspicious RCU usage warning in ip6_pkt_drop():

WARNING: suspicious RCU usage in ip6_pkt_drop

include/net/addrconf.h:389 suspicious rcu_dereference_check() usage!

Call Trace:

__in6_dev_get_safely include/net/addrconf.h:389 [inline]

ip6_pkt_drop+0x596/0x610 net/ipv6/route.c:4620

ip6_pkt_discard+0x1c/0x30 net/ipv6/route.c:4651

xfrm_trans_reinject+0x324/0x630 net/xfrm/xfrm_input.c:806

process_one_work kernel/workqueue.c:3322 [inline]

process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405

worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486

When commit 4f4920669d21 ("xfrm: Reinject transport-mode packets through

workqueue") converted xfrm_trans_reinject from a tasklet to a workqueue,

the reinjection loop ceased running in softirq context. Workqueue workers

run in process context w

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References