« Volver al listado

CVE-2026-80848

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

xfrm: espintcp: fix UAF during close

ZDI reported and analyzed a race condition during close for espintcp sockets:

Fix this by adding a synchronize_rcu() call after resetting sk_prot, since esp_output_tcp_finish() runs under RCU and won't use a socket with sk_prot == &tcp_prot. Simply taking the socket lock in espintcp_close() could lead to leaks, if esp_output_tcp_finish() re-adds an skb in the slot we just freed. After this, the existing barrier() is no longer needed.

Detalles técnicos trazas, registros y código del informe original
    espintcp_close() frees emsg->skb via kfree_skb() without holding
    any socket lock. Concurrently, the xfrm_trans_reinject work queue
    invokes esp_output_tcp_finish() -> espintcp_push_skb() ->
    espintcp_push_msgs() -> skb_send_sock_locked(), which reads the
    same skb as a data source.

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-80848",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "lessThan": "29121c5e6591da527e8e36ddac7120dc527f574d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "lessThan": "ed5d9102190c45fc70121c036b0626b740040b75",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "lessThan": "4bc0dfa28dca6fc0084203732695968049c44072",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "lessThan": "ff8dd7a932f34409a56e1b91a1219340f17457e9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "lessThan": "4b31a875693c480c611519faca46216514e3e052",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "lessThan": "24efebecf415ba264adba0f0491cec436463a14f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "lessThan": "eb3bbf29c723fe75c0eb92be14f0ec92971fe272",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "lessThan": "54b41ad14da9a981131ab6e4d3f79321a503ea5d",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "e27cca96cd68fa2c6814c90f9a1cfd36bb68c593",
              "lessThan": "deb232e884877bf10b4ce2580909eedec986c284",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/xfrm/espintcp.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.6",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.269",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.220",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.187",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.156",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.108",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.49",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.1.13",
              "versionType": "semver",
              "lessThanOrEqual": "7.1.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.3",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/xfrm/espintcp.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-04T16:18:13.540",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/24efebecf415ba264adba0f0491cec436463a14f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/29121c5e6591da527e8e36ddac7120dc527f574d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/4b31a875693c480c611519faca46216514e3e052",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/4bc0dfa28dca6fc0084203732695968049c44072",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/54b41ad14da9a981131ab6e4d3f79321a503ea5d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/deb232e884877bf10b4ce2580909eedec986c284",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/eb3bbf29c723fe75c0eb92be14f0ec92971fe272",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ed5d9102190c45fc70121c036b0626b740040b75",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/ff8dd7a932f34409a56e1b91a1219340f17457e9",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: espintcp: fix UAF during close\n\nZDI reported and analyzed a race condition during close for espintcp\nsockets:\n\n    espintcp_close() frees emsg->skb via kfree_skb() without holding\n    any socket lock. Concurrently, the xfrm_trans_reinject work queue\n    invokes esp_output_tcp_finish() -> espintcp_push_skb() ->\n    espintcp_push_msgs() -> skb_send_sock_locked(), which reads the\n    same skb as a data source.\n\nFix this by adding a synchronize_rcu() call after resetting sk_prot,\nsince esp_output_tcp_finish() runs under RCU and won't use a socket\nwith sk_prot == &tcp_prot.  Simply taking the socket lock in\nespintcp_close() could lead to leaks, if esp_output_tcp_finish()\nre-adds an skb in the slot we just freed. After this, the existing\nbarrier() is no longer needed."
    }
  ],
  "lastModified": "2026-09-04T16:18:13.540",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}