Not yet scoredPublished Sep 4, 2026

CVE-2026-80848xfrm: espintcp: fix UAF during close

Updated under an hour ago (Oct 26, 2026, 5:50 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: xfrm: espintcp: fix UAF during close ZDI reported and analyzed a race condition during close for espintcp sockets: espintcp_close() frees emsg->skb via kfree_skb() without holding any socket lock. Concurrently, the xfrm_trans_reinject work queue invokes esp_output_tcp_finish() -> espintcp_push_skb() -> espintcp_push_msgs() -> skb_send_sock_locked(), which reads the same skb as a data source. Fix this by adding a synchronize_rcu() call after resetting sk_prot, since esp_output_tcp_finish() runs under RCU and won't use a socket with sk_prot == &tcp_prot. Simply taking the socket lock in espintcp_close() could lead to leaks, if esp_output_tcp_finish() re-adds an skb in the slot we just freed. After this, the existing barrier() is no longer needed.

CVSS: Not yet scored
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 before 29121c5e6591da527e8e36ddac7120dc527f574d; from e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 before ed5d9102190c45fc70121c036b0626b740040b75; from e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 before 4bc0dfa28dca6fc0084203732695968049c44072; from e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 before ff8dd7a932f34409a56e1b91a1219340f17457e9; from e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 before 4b31a875693c480c611519faca46216514e3e052; from e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 before 24efebecf415ba264adba0f0491cec436463a14f; from e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 before eb3bbf29c723fe75c0eb92be14f0ec92971fe272; from e27cca96cd68fa2c6814c90f9a1cfd36bb68c593 before 54b41ad14da9a981131ab6e4d3f79321a503ea5d; and 1 more ranges	CNA record

References

References

https://git.kernel.org/stable/c/29121c5e6591da527e8e36ddac7120dc527f574d
https://git.kernel.org/stable/c/ed5d9102190c45fc70121c036b0626b740040b75
https://git.kernel.org/stable/c/4bc0dfa28dca6fc0084203732695968049c44072
https://git.kernel.org/stable/c/ff8dd7a932f34409a56e1b91a1219340f17457e9
https://git.kernel.org/stable/c/4b31a875693c480c611519faca46216514e3e052
https://git.kernel.org/stable/c/24efebecf415ba264adba0f0491cec436463a14f
https://git.kernel.org/stable/c/eb3bbf29c723fe75c0eb92be14f0ec92971fe272
https://git.kernel.org/stable/c/54b41ad14da9a981131ab6e4d3f79321a503ea5d
https://git.kernel.org/stable/c/deb232e884877bf10b4ce2580909eedec986c284

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.