CVE-2026-98230: xfrm: use hlist_del_init_rcu for state_cache and state_cache_input
In the Linux kernel, the following vulnerability has been resolved:
xfrm: use hlistdelinitrcu for statecache and statecacheinput
Commit 14acf9652e56 ("xfrm: defensively unhash xfrmstate lists in xfrmstatedelete") converted bydst/bysrc/byseq/byspi from hlistdelrcu() to hlistdelinitrcu() so that a second xfrmstatedelete() on the same object becomes a no-op rather than a write through LISTPOISON pprev. It missed statecache and statecacheinput, which kept hlistdelrcu():
- hlistdelrcu() leaves pprev = LISTPOISON2 (non-NULL), so hlistunhashed() returns false. - hlistdelinitrcu() leaves pprev = NULL, so hlistunhashed() returns true.
A second xfrmstatedelete() therefore enters hlistdel() on the already-deleted statecache/statecacheinput nodes and does WRITEONCE(pprev, next) through LISTPOISON2 — a write use-after-free once the slab is reused. The corruption can in turn cause a subsequent hlistforeachentryrcu traversal to follow a dangling next pointer, producing the read use-after-free reported in xfrminputstatelookup().
Switch statecache and statecacheinput to hlistdelinitrcu() to match the other four lists, closing the write use-after-free and, with it, the read use-after-free it spawns.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1
Event History
Frequently Asked Questions
What condition is required to trigger the memory corruption?
The same xfrm_state object must reach __xfrm_state_delete() a second time after its state_cache or state_cache_input node has already been deleted. The older deletion behavior leaves the node appearing hashed, allowing the second deletion to operate on poisoned list state.
What is the impact of a repeated deletion?
A second deletion can write through LIST_POISON2 after the associated slab has been reused, causing a write use-after-free. Later traversal of the affected list can follow a dangling next pointer and cause a read use-after-free in xfrm_input_state_lookup().
How can I determine whether a kernel contains the fix?
Check whether deletion of state_cache and state_cache_input uses hlist_del_init_rcu() rather than hlist_del_rcu(). The fix makes already-deleted nodes appear unhashed so a subsequent __xfrm_state_delete() becomes a no-op.