HIGH
xfrm TransReinject UAF
CVE-2026-98369
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI8.1HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject() syzbot reported a suspicious RCU usage warning in ip6_pkt_drop(): WARNING: suspicious RCU usage in ip6_pkt_drop include/net/addrconf.h:389 suspicious rcu_dereference_check() usage! Call Trace: __in6_dev_get_safely include/net/addrconf.h:389 [inline] ip6_pkt_drop+0x596/0x610 net/ipv6/route.c:4620 ip6_pkt_discard+0x1c/0x30 net/ipv6/route.c:4651 xfrm_trans_reinject+0x324/0x630 net/xfrm/xfrm_input.c:806 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486 When commit 4f4920669d21 ("xfrm: Reinject transport-mode packets through workqueue") converted xfrm_trans_reinject from a tasklet to a workqueue, the reinjection loop ceased running in softirq context. Workqueue workers run in process context where local_bh_disable() does not enter an RCU read-side critical section under CONFIG_PREEMPT_RCU. Because finish callbacks (such as ip6_rcv_finish) expect to run under an RCU read lock (performing route lookups, l3mdev lookups, and accessing RCU-protected data structures), invoking them in workqueue context without rcu_read_lock() triggers RCU lockdep warnings. Furthermore, packets queued to the workqueue via xfrm_trans_queue_net() may carry non-refcounted (noref) dst entries (e.g. from ip_route_input_noref). Additionally, on netdevice unregistration, dst_dev_put() replaces dst->dev with blackhole_netdev, so dst entries do not keep skb->dev alive while queued in the workqueue. Fix these issues by: 1. Calling skb_dst_force(skb) in xfrm_trans_queue_net() while still in the caller's RCU section to ensure dst is reference-counted before queuing. 2. Holding a reference on skb->dev via dev_hold()/dev_put() across workqueue deferral so skb->dev remains valid during finish() callback processing. 3. Acquiring rcu_read_lock() around the finish callback invocation loop in xfrm_trans_reinject().
02KernelScan AI Analysis
Risk summary
A remote attacker who can send IPsec packets to a host with XFRM transport-mode security associations can trigger a use-after-free on destination entries and network device structures. The bug stems from a conversion from tasklet to workqueue that dropped implicit RCU protection and reference counting. Successful exploitation could lead to kernel memory disclosure, corruption, or a system crash.
Vulnerability analysis
When the XFRM transport-mode packet reinjection path was converted from a tasklet to a workqueue, the new process-context execution no longer implicitly held an RCU read-side critical section that the finish callbacks depend on for route lookups and access to RCU-protected data. More critically, packets queued for deferred reinjection were not converted from non-refcounted to refcounted destination entries, and no device reference was held across the deferral, so a racing device unregistration or destination entry expiration can free these objects while queued packets still reference them—creating a use-after-free. The fix adds an explicit RCU read lock around the reinjection loop, forces destination entries to be reference-counted before queuing, and holds a device reference across the workqueue deferral. This path is reachable by a remote attacker who can send IPsec packets to a host with transport-mode security associations configured, though exploiting the use-after-free requires winning a race with device teardown or destination entry expiration.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | 5.15.75 | 5.15.222 | 41e47f1664be |
| 5.19 | 5.19.17 | 5.20 | 6601d91a8576 |
| 6.0 | 6.0.3 | 6.1 | 0cda8273265d |
| 6.1 | — | 6.1.189 | 68a317b4aec8 |
| 6.6 | — | 6.6.158 | 6eb3b071be8e |
| 6.12 | — | 6.12.112 | 664fc0941df7 |
| 6.18 | — | 6.18.54 | d2f5082f9e84 |
| 7.2 | — | 7.2.8 | — |
| mainline | — | 7.3-rc4 | — |