CVE-2026-80848 xfrm: espintcp: fix UAF during close
A race condition in the Linux kernel's espintcp module allows attackers to trigger a use-after-free, potentially leading to code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80848?
CVE-2026-80848 is an use after free vulnerability in Linux, published on 4 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
xfrm: espintcp: fix UAF during close
ZDI reported and analyzed a race condition during close for espintcp sockets:
espintcp_close() frees emsg->skb via kfree_skb() without holding any socket lock. Concurrently, the xfrm_trans_reinject work queue invokes esp_output_tcp_finish() -> espintcp_push_skb() -> espintcp_push_msgs() -> skb_send_sock_locked(), which reads the same skb as a data source.
Fix this by adding a synchronize_rcu() call after resetting sk_prot, since esp_output_tcp_finish() runs under RCU and won't use a socket with sk_prot == &tcp_prot. Simply taking the socket lock in espintcp_close() could lead to leaks, if esp_output_tcp_finish() re-adds an skb in the slot we just freed. After this, the existing barrier() is no longer needed.
Which versions are affected by CVE-2026-80848?
How do I fix CVE-2026-80848?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-80848 being exploited?
There is no known exploitation of CVE-2026-80848 in the wild and no public exploit code.
Sources
Also known as AZL-99564, BELL-CVE-2026-80848, DEBIAN-CVE-2026-80848, GHSA-gvv5-3h67-3922, UBUNTU-CVE-2026-80848.