{"id":"AZL-99564","summary":"CVE-2026-80848 affecting package kernel 6.6.150.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: espintcp: fix UAF during close\n\nZDI reported and analyzed a race condition during close for espintcp\nsockets:\n\n    espintcp_close() frees emsg-\u003eskb via kfree_skb() without holding\n    any socket lock. Concurrently, the xfrm_trans_reinject work queue\n    invokes esp_output_tcp_finish() -\u003e espintcp_push_skb() -\u003e\n    espintcp_push_msgs() -\u003e skb_send_sock_locked(), which reads the\n    same skb as a data source.\n\nFix this by adding a synchronize_rcu() call after resetting sk_prot,\nsince esp_output_tcp_finish() runs under RCU and won't use a socket\nwith sk_prot == &tcp_prot.  Simply taking the socket lock in\nespintcp_close() could lead to leaks, if esp_output_tcp_finish()\nre-adds an skb in the slot we just freed. After this, the existing\nbarrier() is no longer needed.","modified":"2026-09-07T05:28:29Z","published":"2026-09-04T16:18:13Z","upstream":["CVE-2026-80848"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80848"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.150.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-99564.json"}}],"schema_version":"1.9.0"}