CVE-2026-98370

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

xfrm: fix compat ALLOCSPI request use-after-free

xfrm_state_netlink() builds the ALLOCSPI response with

dump_one_state(), which already calls alloc_compat() with the response

skb and header.

xfrm_alloc_userspi() then calls alloc_compat() again, but passes the

original request skb and its header. For a compat request, the

translator therefore interprets the 228-byte compat xfrm_userspi_info

as the 232-byte native layout and reads four bytes past the declared

payload. It also publishes the translated child through the request's

frag_list.

A multicast clone of the request shares skb_shared_info and can observe

that child. xfrm_user_rcv_msg() frees it after the request handler

returns, racing a compat receiver which may still be copying from it and

resulting in a use-after-free.

Remove the redundant conversion. The response keeps its correct compat

translation from dump_one_state(), and no child is attached to the

inb

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References