Vulnpedia
← Search CVEs

CVE-2026-98231

N/A

Published 2026-10-06 · Last modified 2026-10-19

In the Linux kernel, the following vulnerability has been resolved: xfrm: serialize state GC with device state flush The deferred-device pass in xfrm_dev_state_flush() finds states under xfrm_state_dev_gc_lock, but drops the lock before calling xfrm_dev_state_free() because the driver callback may sleep. The device GC list does not hold an xfrm_state reference, so the state GC worker can destroy the same state concurrently. The race can proceed as follows: CPU 0 CPU 1 find x on the device GC list drop xfrm_state_dev_gc_lock read x->xso.dev xfrm_state_gc_destroy(x) xfrm_dev_state_free(x) xfrm_state_free(x) continue xfrm_dev_state_free(x) Both paths can invoke the driver callback and drop the device reference. CPU 0 can also access the xfrm_state after CPU 1 has freed it. KASAN reported: BUG: KASAN: slab-use-after-free in xfrm_dev_state_free+0x24c/0x2a0 Read of size 8 at addr ffff88810bbaa960 by task poc/102 Call Trace: xfrm_dev_state_free+0x24c/0x2a0 xfrm_dev_state_flush+0x353/0x400 xfrm_dev_event+0x26d/0x3a0 notifier_call_chain+0xc0/0x280 __dev_notify_flags+0x169/0x250 netif_change_flags+0xe7/0x160 dev_change_flags+0x96/0x220 devinet_ioctl+0x7f4/0x1880 Allocated by task 87: xfrm_state_alloc+0x1e/0x5c0 xfrm_add_sa+0xe7f/0x5820 xfrm_user_rcv_msg+0x4f3/0x940 Freed by task 57: kmem_cache_free+0xcb/0x3d0 xfrm_state_gc_task+0x4a8/0x650 process_one_work+0x63a/0x1070 Serialize xfrm_state destruction against the deferred-device pass with a mutex. Keep xfrm_state_dev_gc_lock limited to list operations and retain the existing callback and device-reference release ordering.

NO EXPLOITATION SIGNALS

No known exploitation, public exploit, or elevated probability at this time. Track for changes.

Exploitation likelihood

0.2%chance of exploitation in 30 days · 10th percentile

○ In CISA KEV ○ Catalogued PoC

Impact if exploited

—CVSS · not scored

  • No impact metrics

Proof of concept

No public PoC is currently catalogued.

Search for new PoCs

Search GitHub now — results may be empty or unverified.

Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.

Data snapshot:

Affected

Vendors Linux

Products Linux

Weakness (CWE)

Not classified.

CVSS vector

Not yet scored.

References and research data (JSON)

Vendor product assessments

Showing 32 of 278 vendor product statements; 246 omitted. Read the full vendor advisory.

  • kernel as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel

    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • none available: Fix deferred
    Red Hat · CVE-2026-98231 · Updated 2026-10-22T00:50:38+00:00
  • kernel-64k-modules as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-64k-modules

    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • none available: Fix deferred
    Red Hat · CVE-2026-98231 · Updated 2026-10-22T00:50:38+00:00
  • kernel-devel as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-devel

    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • none available: Fix deferred
    Red Hat · CVE-2026-98231 · Updated 2026-10-22T00:50:38+00:00
  • kernel-rt-64k-debug-core as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-rt-64k-debug-core

    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • none available: Fix deferred
    Red Hat · CVE-2026-98231 · Updated 2026-10-22T00:50:38+00:00
  • kernel-rt-debug-devel as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-rt-debug-devel

    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • none available: Fix deferred
    Red Hat · CVE-2026-98231 · Updated 2026-10-22T00:50:38+00:00
  • kernel-tools-libs-devel as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-tools-libs-devel

    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • none available: Fix deferred
    Red Hat · CVE-2026-98231 · Updated 2026-10-22T00:50:38+00:00
  • python3-perf as a component of Red Hat Enterprise Linux 10 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/python3-perf

    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • none available: Fix deferred
    Red Hat · CVE-2026-98231 · Updated 2026-10-22T00:50:38+00:00
  • kernel-64k-debug-modules-core as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-64k-debug-modules-core

    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • none available: Fix deferred
    Red Hat · CVE-2026-98231 · Updated 2026-10-22T00:50:38+00:00
  • kernel-core as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-core

    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • none available: Fix deferred
    Red Hat · CVE-2026-98231 · Updated 2026-10-22T00:50:38+00:00
  • kernel-debug-uki-virt-addons as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-debug-uki-virt-addons

    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • none available: Fix deferred
    Red Hat · CVE-2026-98231 · Updated 2026-10-22T00:50:38+00:00
  • kernel-rt-64k as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-rt-64k

    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • none available: Fix deferred
    Red Hat · CVE-2026-98231 · Updated 2026-10-22T00:50:38+00:00
  • kernel-rt-64k-devel as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-rt-64k-devel

    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • none available: Fix deferred
    Red Hat · CVE-2026-98231 · Updated 2026-10-22T00:50:38+00:00
  • kernel-rt-debug-devel-matched as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-rt-debug-devel-matched

    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • none available: Fix deferred
    Red Hat · CVE-2026-98231 · Updated 2026-10-22T00:50:38+00:00
  • kernel-rt-modules-extra as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-rt-modules-extra

    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • none available: Fix deferred
    Red Hat · CVE-2026-98231 · Updated 2026-10-22T00:50:38+00:00
  • kernel-zfcpdump-modules as a component of Red Hat Enterprise Linux 9 · known affected

    Vendor assessment for this product only.

    pkg:rpm/redhat/kernel-zfcpdump-modules

    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • none available: Fix deferred
    Red Hat · CVE-2026-98231 · Updated 2026-10-22T00:50:38+00:00
  • openshift/ose-rhel-coreos-9 as a component of Red Hat OpenShift Container Platform 4 · known affected

    Vendor assessment for this product only.

    pkg:oci/ose-rhel-coreos-9?repository_url=registry.redhat.io/openshift/ose-rhel-coreos-9

    • workaround: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
    • none available: Fix deferred
    Red Hat · CVE-2026-98231 · Updated 2026-10-22T00:50:38+00:00
  • kernel as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel

    Red Hat · CVE-2026-98231 · Updated 2026-10-22T00:50:38+00:00
  • kernel-doc as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-doc

    Red Hat · CVE-2026-98231 · Updated 2026-10-22T00:50:38+00:00
  • perf as a component of Red Hat Enterprise Linux 6 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/perf

    Red Hat · CVE-2026-98231 · Updated 2026-10-22T00:50:38+00:00
  • kernel-debug as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-debug

    Red Hat · CVE-2026-98231 · Updated 2026-10-22T00:50:38+00:00
  • kernel-rt as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-rt

    Red Hat · CVE-2026-98231 · Updated 2026-10-22T00:50:38+00:00
  • kernel-rt-kvm as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-rt-kvm

    Red Hat · CVE-2026-98231 · Updated 2026-10-22T00:50:38+00:00
  • kernel-tools-libs as a component of Red Hat Enterprise Linux 7 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-tools-libs

    Red Hat · CVE-2026-98231 · Updated 2026-10-22T00:50:38+00:00
  • kernel as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel

    Red Hat · CVE-2026-98231 · Updated 2026-10-22T00:50:38+00:00
  • kernel-debug-core as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-debug-core

    Red Hat · CVE-2026-98231 · Updated 2026-10-22T00:50:38+00:00
  • kernel-doc as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-doc

    Red Hat · CVE-2026-98231 · Updated 2026-10-22T00:50:38+00:00
  • kernel-rt as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-rt

    Red Hat · CVE-2026-98231 · Updated 2026-10-22T00:50:38+00:00
  • kernel-rt-debug-modules as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-rt-debug-modules

    Red Hat · CVE-2026-98231 · Updated 2026-10-22T00:50:38+00:00
  • kernel-rt-modules-internal as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-rt-modules-internal

    Red Hat · CVE-2026-98231 · Updated 2026-10-22T00:50:38+00:00
  • kernel-tools-libs-devel as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-tools-libs-devel

    Red Hat · CVE-2026-98231 · Updated 2026-10-22T00:50:38+00:00
  • kernel-zfcpdump-modules-internal as a component of Red Hat Enterprise Linux 8 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:rpm/redhat/kernel-zfcpdump-modules-internal

    Red Hat · CVE-2026-98231 · Updated 2026-10-22T00:50:38+00:00
  • openshift/ose-rhel-coreos-8 as a component of Red Hat OpenShift Container Platform 4 · known not affected

    Vendor assessment for this product only.

    Reason: vulnerable code not present

    pkg:oci/ose-rhel-coreos-8?repository_url=registry.redhat.io/openshift/ose-rhel-coreos-8

    Red Hat · CVE-2026-98231 · Updated 2026-10-22T00:50:38+00:00

References

Advisories

Technical & other

Sources: NVD · CVE.org · EPSS