CVE-2026-80848
Description
A flaw was found in the xfrm: espintcp component of the Linux kernel. A race condition exists during the closure of espintcp sockets, where a memory buffer (skb) can be freed while still being accessed by another process. This Use-After-Free (UAF) vulnerability could allow a local attacker to cause memory corruption, potentially leading to a denial of service or other unpredictable system behavior.
Statement
A race condition leading to a use-after-free was found in the Linux kernel's xfrm/espintcp (TCP encapsulation of IPsec ESP) implementation. Red Hat Product Security has rated this flaw as IMPORTANT (CVSS 3.1: 7.0, AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The kernel and kernel-rt packages in Red Hat Enterprise Linux 8, 9, and 10 are affected, as are Red Hat OpenShift and Red Hat In-Vehicle OS streams that ship a vulnerable kernel; a fix is being pursued for the affected streams. Red Hat Enterprise Linux 6 and 7 are not affected because the vulnerable code is not present in those streams.
During the close of an espintcp socket, espintcp_close() frees emsg->skb via kfree_skb() without holding any socket lock, while the xfrm_trans_reinject work queue can concurrently read the same skb through esp_output_tcp_finish() -> espintcp_push_skb() -> espintcp_push_msgs() -> skb_send_sock_locked(). A local attacker able to trigger this race could cause kernel memory corruption, potentially leading to a denial of service or other unpredictable system behavior. Exploitation requires local access, success in a narrow timing window, and a system using TCP-encapsulated IPsec (espintcp) sockets.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
