CVE-2026-98370 xfrm: fix compat ALLOCSPI request use-after-free
A use-after-free in the Linux kernel xfrm subsystem allows local attackers to execute arbitrary code or escalate privileges via crafted netlink messages.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98370?
CVE-2026-98370 is an use after free vulnerability in Linux, published on 6 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
xfrm: fix compat ALLOCSPI request use-after-free
xfrm_state_netlink() builds the ALLOCSPI response with dump_one_state(), which already calls alloc_compat() with the response skb and header.
xfrm_alloc_userspi() then calls alloc_compat() again, but passes the original request skb and its header. For a compat request, the translator therefore interprets the 228-byte compat xfrm_userspi_info as the 232-byte native layout and reads four bytes past the declared payload. It also publishes the translated child through the request's frag_list.
A multicast clone of the request shares skb_shared_info and can observe that child. xfrm_user_rcv_msg() frees it after the request handler returns, racing a compat receiver which may still be copying from it and resulting in a use-after-free.
Remove the redundant conversion. The response keeps its correct compat translation from dump_one_state(), and no child is attached to the inbound request.
Which versions are affected by CVE-2026-98370?
How do I fix CVE-2026-98370?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-98370 being exploited?
There is no known exploitation of CVE-2026-98370 in the wild and no public exploit code.
Sources
Also known as AZL-106011, BELL-CVE-2026-98370, DEBIAN-CVE-2026-98370, GHSA-xf8r-gcp9-vg22, UBUNTU-CVE-2026-98370.