In the Linux kernel, the following vulnerability has been resolved: nfp: hold IPsec RX state under the XArray lock nfp_net_ipsec_rx() drops the… (CVE-2026-98561)

The vulnerability in the Linux kernel's nfp driver involves the nfp_net_ipsec_rx() function dropping the XArray lock before acquiring a reference to the xfrm_state it found. This allows the delete path to erase the entry and drop the last state reference concurrently, leading to attempts to increment a zero reference count after the state has been queued for destruction. The asynchronous nature of firmware invalidation and the delayed reclamation by the XFRM garbage collector do not prevent this invalid reference acquisition. The resolution is to acquire the xfrm_state reference before releasing the XArray lock, preventing xa_erase() from running between lookup and reference acquisition.

This vulnerability could cause use-after-free or reference count corruption in the IPsec RX state handling within the Linux kernel's nfp driver. Such issues may lead to kernel instability or crashes. There is no indication of known exploits in the wild. The impact is limited to the affected driver code and could affect systems using this driver for IPsec processing.

A fix has been implemented that changes the code to acquire the xfrm_state reference before releasing the XArray lock, preventing the race condition. Users should apply the official Linux kernel updates that include this fix once available. Patch status is not explicitly confirmed in the provided data; check the vendor advisory or Linux kernel mailing lists for the current remediation status.