{ "schemaVersion": 1, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "record": { "id": "CVE-2026-98369", "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-98369", "idYear": 2026, "status": "PUBLISHED", "publishedAt": "2026-10-06T08:46:54.188Z", "updatedAt": "2026-10-19T09:18:21.221Z", "importedAt": "2026-10-24T01:58:41.756Z", "snapshot": { "id": "cve_2026-10-24_midnight_baseline", "at": "2026-10-24T00:00:00.000Z", "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z" }, "facts": { "title": "xfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: add missing rcu_read_lock(), skb_dst_force() and dev_hold() for xfrm_trans_reinject()\n\nsyzbot reported a suspicious RCU usage warning in ip6_pkt_drop():\n\n WARNING: suspicious RCU usage in ip6_pkt_drop\n include/net/addrconf.h:389 suspicious rcu_dereference_check() usage!\n\n Call Trace:\n __in6_dev_get_safely include/net/addrconf.h:389 [inline]\n ip6_pkt_drop+0x596/0x610 net/ipv6/route.c:4620\n ip6_pkt_discard+0x1c/0x30 net/ipv6/route.c:4651\n xfrm_trans_reinject+0x324/0x630 net/xfrm/xfrm_input.c:806\n process_one_work kernel/workqueue.c:3322 [inline]\n process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405\n worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486\n\nWhen commit 4f4920669d21 (\"xfrm: Reinject transport-mode packets through\nworkqueue\") converted xfrm_trans_reinject from a tasklet to a workqueue,\nthe reinjection loop ceased running in softirq context. Workqueue workers\nrun in process context where local_bh_disable() does not enter an RCU\nread-side critical section under CONFIG_PREEMPT_RCU.\n\nBecause finish callbacks (such as ip6_rcv_finish) expect to run under an\nRCU read lock (performing route lookups, l3mdev lookups, and accessing\nRCU-protected data structures), invoking them in workqueue context without\nrcu_read_lock() triggers RCU lockdep warnings.\n\nFurthermore, packets queued to the workqueue via xfrm_trans_queue_net()\nmay carry non-refcounted (noref) dst entries (e.g. from ip_route_input_noref).\nAdditionally, on netdevice unregistration, dst_dev_put() replaces dst->dev\nwith blackhole_netdev, so dst entries do not keep skb->dev alive while\nqueued in the workqueue.\n\nFix these issues by:\n1. Calling skb_dst_force(skb) in xfrm_trans_queue_net() while still in the\n caller's RCU section to ensure dst is reference-counted before queuing.\n2. Holding a reference on skb->dev via dev_hold()/dev_put() across workqueue\n deferral so skb->dev remains valid during finish() callback processing.\n3. Acquiring rcu_read_lock() around the finish callback invocation loop in\n xfrm_trans_reinject().", "affected": [ { "vendor": "Linux", "product": "Linux", "defaultStatus": "unaffected", "versions": [ { "version": "7d98b26684cb2390729525b341ea099f0badbe18", "status": "affected", "versionType": "git", "lessThan": "41e47f1664be86c91326f0afe0504a1162d00907" }, { "version": "4f4920669d21e1060b7243e5118dc3b71ced1276", "status": "affected", "versionType": "git", "lessThan": "6601d91a85761f33351c71e04ec0bbd294ca07ce" }, { "version": "4f4920669d21e1060b7243e5118dc3b71ced1276", "status": "affected", "versionType": "git", "lessThan": "0cda8273265d30cac6423834fd7d4acb75f04fdb" }, { "version": "4f4920669d21e1060b7243e5118dc3b71ced1276", "status": "affected", "versionType": "git", "lessThan": "68a317b4aec8ca1868a39d69e40f9e29baa4f40a" }, { "version": "4f4920669d21e1060b7243e5118dc3b71ced1276", "status": "affected", "versionType": "git", "lessThan": "6eb3b071be8e260543c604550c54dac66e6b174b" }, { "version": "4f4920669d21e1060b7243e5118dc3b71ced1276", "status": "affected", "versionType": "git", "lessThan": "664fc0941df7c1918b2cd4de6ee00469ba77d8e4" }, { "version": "4f4920669d21e1060b7243e5118dc3b71ced1276", "status": "affected", "versionType": "git", "lessThan": "d2f5082f9e84653fa1a9e8aebaaff23e688f5e19" }, { "version": "f520075da484306bbb8425afd2c42404ba74816f", "status": "affected", "versionType": "git" }, { "version": "130d9e5017ade1b81d16783563edb38c12a2eab7", "status": "affected", "versionType": "git" }, { "version": "5.15.75", "status": "affected", "versionType": "semver", "lessThan": "5.15.222" }, { "version": "5.19.17", "status": "affected", "versionType": "semver", "lessThan": "5.20" }, { "version": "6.0.3", "status": "affected", "versionType": "semver", "lessThan": "6.1" } ] }, { "vendor": "Linux", "product": "Linux", "defaultStatus": "affected", "versions": [ { "version": "6.1", "status": "affected" }, { "version": "0", "status": "unaffected", "versionType": "semver", "lessThan": "6.1" }, { "version": "5.15.222", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.15.*" }, { "version": "6.1.189", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.1.*" }, { "version": "6.6.158", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.6.*" }, { "version": "6.12.112", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.12.*" }, { "version": "6.18.54", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.18.*" }, { "version": "7.2.8", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "7.2.*" }, { "version": "7.3", "status": "unaffected", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*" } ] } ] } } }