VulnerabilityPublished 6 Oct 2026Updated 19 Oct 2026

CVE-2026-98370: Linux kernel · xfrm: fix compat ALLOCSPI request use-after-free

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in e70f639aee2ff0def155c256cace9e0f81d998e2 : patch Linux kernel soon.

Data as of 26 Oct 2026, 12:55 UTC

Severity

High

Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in e70f639aee2ff0def155c256cace9e0f81d998e2, d1ebd9081879fd9ae9c8fb7e8928f19cc88ae320, bb63ab52a18273ec68340ac49aebbaa7b514ccd5 +5

Exploitation evidence

Disclosed: evidence found.
CVE published 6 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3, < e70f639aee2ff0def155c256cace9e0f81d998e2	Fixed in e70f639aee2ff0def155c256cace9e0f81d998e2
LinuxLinux	Affected ≥ 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3, < d1ebd9081879fd9ae9c8fb7e8928f19cc88ae320	Fixed in d1ebd9081879fd9ae9c8fb7e8928f19cc88ae320
LinuxLinux	Affected ≥ 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3, < bb63ab52a18273ec68340ac49aebbaa7b514ccd5	Fixed in bb63ab52a18273ec68340ac49aebbaa7b514ccd5
LinuxLinux	Affected ≥ 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3, < 248433942155b42a0ef04a5806c8aca024ea7c33	Fixed in 248433942155b42a0ef04a5806c8aca024ea7c33
LinuxLinux	Affected ≥ 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3, < 17893987e52918c23945c42e47e894a936305a25	Fixed in 17893987e52918c23945c42e47e894a936305a25
LinuxLinux	Affected ≥ 5f3eea6b7e8f58cf5c8a9d4b9679dc19e9e67ba3, < 42971ea17c7a8afc0bdd5ca40648bf4e5bb7b810	Fixed in 42971ea17c7a8afc0bdd5ca40648bf4e5bb7b810

AI-suggested

A fix is available and has been applied in the Linux kernel commits identified by hashes such as e70f639aee2ff0def155c256cace9e0f81d998e2 and others. Users should update their Linux kernel to a version including these fixes to remediate the vulnerability. No additional mitigation actions are indicated by the vendor advisory.

Description

CVE-2026-98370 is a use-after-free vulnerability in the Linux kernel's xfrm subsystem related to the handling of compat ALLOCSPI requests. The issue arises from redundant conversion calls that cause the kernel to read beyond the intended payload and free memory prematurely, potentially leading to memory corruption.

Impact

The use-after-free vulnerability can lead to memory corruption in the Linux kernel's xfrm subsystem. This may cause system instability or potentially allow an attacker to execute arbitrary code or cause denial of service, depending on exploitation context. However, no known exploits in the wild have been reported.

Summary

The vulnerability in the Linux kernel's xfrm subsystem involves the xfrm_state_netlink() function building an ALLOCSPI response using dump_one_state(), which correctly calls alloc_compat() with the response skb and header. However, xfrm_alloc_userspi() redundantly calls alloc_compat() again with the original request skb and header. This causes the translator to misinterpret the 228-byte compat xfrm_userspi_info as a 232-byte native layout, reading four bytes beyond the payload. Additionally, a multicast clone of the request shares skb_shared_info and can observe a translated child that is freed by xfrm_user_rcv_msg() after the request handler returns, racing with a compat receiver still copying from it, resulting in a use-after-free condition. The fix removes the redundant conversion, preserving the correct compat translation and preventing the child from being attached to the inbound request.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 11:35 UTC

Technical details

References

Community reviews

Related threats