In the Linux kernel, the following vulnerability has been resolved: strparser: make sure __strp_recv isn't running before tearing down the parser… (CVE-2026-99056)

The vulnerability in the Linux kernel's strparser arises from a race condition where __strp_recv might still be executing when the parser is torn down, violating assumptions about the stopping of strp_recv calls. This could cause a use-after-free condition leading to crashes or potential exploitation. The fix involves adding a dummy lock_sock/release_sock pair to ensure any in-flight strp_recv calls complete before teardown. The issue specifically affects espintcp, the only user of strp_recv impacted by this race. The general mode of strp, which could also crash, is unused and will be removed. A reproducer and exploit have been published, demonstrating the vulnerability's exploitability.

The vulnerability could cause kernel crashes or potentially be exploited due to a use-after-free condition in the strparser component of the Linux kernel. Only the espintcp user is affected by this race condition. No known active exploitation in the wild has been reported.

A patch has been applied to the Linux kernel to add locking mechanisms that prevent the race condition by ensuring __strp_recv is not running during parser teardown. Users should update to the fixed kernel version once available. No other mitigation is indicated.