{"id":"CVE-2026-98230","state":"PUBLISHED","title":"xfrm: use hlist_del_init_rcu for state_cache and state_cache_input","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: use hlist_del_init_rcu for state_cache and state_cache_input\n\nCommit 14acf9652e56 (\"xfrm: defensively unhash xfrm_state lists in\n__xfrm_state_delete\") converted bydst/bysrc/byseq/byspi from\nhlist_del_rcu() to hlist_del_init_rcu() so that a second\n__xfrm_state_delete() on the same object becomes a no-op rather than a\nwrite through LIST_POISON pprev. It missed state_cache and\nstate_cache_input, which kept hlist_del_rcu():\n\n- hlist_del_rcu() leaves pprev = LIST_POISON2 (non-NULL), so\n  hlist_unhashed() returns false.\n- hlist_del_init_rcu() leaves pprev = NULL, so hlist_unhashed()\n  returns true.\n\nA second __xfrm_state_delete() therefore enters __hlist_del() on the\nalready-deleted state_cache/state_cache_input nodes and does\nWRITE_ONCE(*pprev, next) through LIST_POISON2 — a write use-after-free\nonce the slab is reused. The corruption can in turn cause a subsequent\nhlist_for_each_entry_rcu traversal to follow a dangling next pointer,\nproducing the read use-after-free reported in xfrm_input_state_lookup().\n\nSwitch state_cache and state_cache_input to hlist_del_init_rcu() to\nmatch the other four lists, closing the write use-after-free and, with\nit, the read use-after-free it spawns.","publishedAt":"2026-10-06T08:45:04.548Z","updatedAt":"2026-10-19T09:16:02.121Z","severity":{"score":7,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"aa48a18fdb0911572d133057cd579db704b87da4","status":"affected","lessThan":"fb38fb7420d5f7192f9e2b6ac835ede149cd7ac5","versionType":"git"},{"version":"0045e3d80613cc7174dc15f189ee6fc4e73b9365","status":"affected","lessThan":"4748c27e2e6a1969e02f1df46e62f79d2799b80b","versionType":"git"},{"version":"0045e3d80613cc7174dc15f189ee6fc4e73b9365","status":"affected","lessThan":"9b74a47a4cbd0d29faff4f3b199212c73e6b6220","versionType":"git"},{"version":"0045e3d80613cc7174dc15f189ee6fc4e73b9365","status":"affected","lessThan":"2afb8dc1f4390f164db8352f8e685e126e9db566","versionType":"git"},{"version":"5e4334dc39443645415450163ff5ff1ee7e79784","status":"affected","versionType":"git"},{"version":"6.12.13","status":"affected","lessThan":"6.12.112","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/xfrm/xfrm_state.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.13","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.13","versionType":"semver"},{"version":"6.12.112","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.54","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.8","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/xfrm/xfrm_state.c"]}],"references":["https://git.kernel.org/stable/c/fb38fb7420d5f7192f9e2b6ac835ede149cd7ac5","https://git.kernel.org/stable/c/4748c27e2e6a1969e02f1df46e62f79d2799b80b","https://git.kernel.org/stable/c/9b74a47a4cbd0d29faff4f3b199212c73e6b6220","https://git.kernel.org/stable/c/2afb8dc1f4390f164db8352f8e685e126e9db566"],"weaknesses":[],"ingestedAt":"2026-10-29T20:13:43.249Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/98xxx/CVE-2026-98230.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-98230","state":"PUBLISHED","datePublished":"2026-10-06T08:45:04.548Z","dateUpdated":"2026-10-19T09:16:02.121Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-09-25T10:25:14.328Z"},"containers":{"cna":{"title":"xfrm: use hlist_del_init_rcu for state_cache and state_cache_input","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: use hlist_del_init_rcu for state_cache and state_cache_input\n\nCommit 14acf9652e56 (\"xfrm: defensively unhash xfrm_state lists in\n__xfrm_state_delete\") converted bydst/bysrc/byseq/byspi from\nhlist_del_rcu() to hlist_del_init_rcu() so that a second\n__xfrm_state_delete() on the same object becomes a no-op rather than a\nwrite through LIST_POISON pprev. It missed state_cache and\nstate_cache_input, which kept hlist_del_rcu():\n\n- hlist_del_rcu() leaves pprev = LIST_POISON2 (non-NULL), so\n  hlist_unhashed() returns false.\n- hlist_del_init_rcu() leaves pprev = NULL, so hlist_unhashed()\n  returns true.\n\nA second __xfrm_state_delete() therefore enters __hlist_del() on the\nalready-deleted state_cache/state_cache_input nodes and does\nWRITE_ONCE(*pprev, next) through LIST_POISON2 — a write use-after-free\nonce the slab is reused. The corruption can in turn cause a subsequent\nhlist_for_each_entry_rcu traversal to follow a dangling next pointer,\nproducing the read use-after-free reported in xfrm_input_state_lookup().\n\nSwitch state_cache and state_cache_input to hlist_del_init_rcu() to\nmatch the other four lists, closing the write use-after-free and, with\nit, the read use-after-free it spawns."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"aa48a18fdb0911572d133057cd579db704b87da4","status":"affected","lessThan":"fb38fb7420d5f7192f9e2b6ac835ede149cd7ac5","versionType":"git"},{"version":"0045e3d80613cc7174dc15f189ee6fc4e73b9365","status":"affected","lessThan":"4748c27e2e6a1969e02f1df46e62f79d2799b80b","versionType":"git"},{"version":"0045e3d80613cc7174dc15f189ee6fc4e73b9365","status":"affected","lessThan":"9b74a47a4cbd0d29faff4f3b199212c73e6b6220","versionType":"git"},{"version":"0045e3d80613cc7174dc15f189ee6fc4e73b9365","status":"affected","lessThan":"2afb8dc1f4390f164db8352f8e685e126e9db566","versionType":"git"},{"version":"5e4334dc39443645415450163ff5ff1ee7e79784","status":"affected","versionType":"git"},{"version":"6.12.13","status":"affected","lessThan":"6.12.112","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/xfrm/xfrm_state.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.13","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.13","versionType":"semver"},{"version":"6.12.112","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.54","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.2.8","status":"unaffected","lessThanOrEqual":"7.2.*","versionType":"semver"},{"version":"7.3","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/xfrm/xfrm_state.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/fb38fb7420d5f7192f9e2b6ac835ede149cd7ac5"},{"url":"https://git.kernel.org/stable/c/4748c27e2e6a1969e02f1df46e62f79d2799b80b"},{"url":"https://git.kernel.org/stable/c/9b74a47a4cbd0d29faff4f3b199212c73e6b6220"},{"url":"https://git.kernel.org/stable/c/2afb8dc1f4390f164db8352f8e685e126e9db566"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The bad unlink is in __xfrm_state_delete(), reached when SAs are removed via XFRM_MSG_DELSA/FLUSHSA/EXPIRE over NETLINK_XFRM or the af_key socket, or via xfrm_timer_handler expiry. ESP packets only walk state_cache_input in xfrm_input_state_lookup() and carry no malformed data that causes the double unlink, so the vector is local.\nAC:H - A second unlink needs __xfrm_state_delete() to see a non-DEAD state that was already removed, but every caller holds x->lock and checks km.state. The only path found that skips the VALID check is mlx5e_ipsec_handle_event(), which calls xfrm_state_check_expire() on a hardware hard-limit event and needs mlx5 packet offload, so the attacker cannot reliably arrange it.\nPR:L - Adding, expiring and flushing SAs over NETLINK_XFRM needs CAP_NET_ADMIN only in the user namespace that owns the netns. An unprivileged user gets it with unshare -Urn, and each netns has its own state_cache_input percpu lists and xfrm_state_lock.\nUI:N - The attacker drives the SA lifecycle (add, expire, delete, flush) and the traffic that fills the state caches themselves. No other user has to do anything.\nS:U - The corrupted hlist nodes are inside struct xfrm_state in kernel slab memory, so the impact stays within the kernel's own security authority.\nC:H - After the stale-pprev unlink, the state_cache_input chain can keep a freed xfrm_state, which hlist_for_each_entry_rcu in xfrm_input_state_lookup() then dereferences (the read UAF the commit reports). With slab reuse, an attacker can control the contents of that object.\nI:H - __hlist_del() on an already-unlinked state_cache/state_cache_input node does WRITE_ONCE(*pprev, next) through a stale pointer, a write use-after-free into reused slab memory that corrupts RCU hash-chain linkage.\nA:H - Writing through LIST_POISON2, or walking the corrupted per-CPU state_cache_input or policy state_cache_list chain, causes a general protection fault or KASAN oops in softirq or netns cleanup context, which takes down the kernel."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-19T09:16:02.121Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12.13","versionEndExcluding":"6.12.112"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"6.18.54"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"7.2.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.13","versionEndExcluding":"7.3"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}