CVE-2026-98369
Description
A flaw was found in the Linux kernel's IPsec (xfrm) subsystem. This flaw can lead to a Denial of Service (DoS) due to missing synchronization locks and device references when reinjecting transport-mode network packets through workqueues. A remote attacker could exploit this vulnerability by sending network traffic processed by IPsec, causing the kernel to access invalid memory structures and resulting in a system crash.
Statement
A Moderate impact flaw was found in the Linux kernel IPsec (xfrm) subsystem, affecting the kernel packages in Red Hat Enterprise Linux 9 and 10, Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases that ship the RHEL 9 based CoreOS. Upstream commit 4f4920669d21 ("xfrm: Reinject transport-mode packets through workqueue") moved transport-mode packet reinjection from a tasklet to a workqueue; in workqueue (process) context the finish callbacks run without the RCU read lock they expect, and queued packets may carry non-refcounted destination entries and no longer hold a reference to their network device. As a result, network traffic processed by IPsec transport mode can cause the kernel to access invalid memory structures and crash, resulting in a denial of service. Red Hat Enterprise Linux 6 ELS is out of support scope, and Red Hat Enterprise Linux 7 and 8, including kernel-rt and the OpenShift release based on the RHEL 8 CoreOS, are not affected because the vulnerable code is not present in those versions. For the affected products the fix is deferred to a future update, leaving a residual risk that an attacker able to send traffic processed by IPsec to an affected system can crash the kernel. Red Hat rates this flaw as Moderate (CVSS 5.5, availability-only impact), which differs from the upstream CVE record score of 7.8 (Important) that also assumes high confidentiality and integrity impacts not supported by the technical evidence.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | High |
| Integrity Impact | None | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Integrity,Confidentiality,Other
Technical Impact: Modify Application Data; Read Application Data; Alter Execution Logic
If access to a shared resource is not synchronized, then the resource may not be in a state that is expected by the product. This might lead to unexpected or insecure behaviors, especially if an attacker can influence the shared resource.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
